VYPR

CVEs

31,844 total · page 584 of 637

AllCriticalHighKEV
  • CVE-2016-3349HigSep 14, 2016
    Microsoft
    Windows Server 2012
    risk 0.51cvss 7.8epss 0.01

    The kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

  • CVE-2016-3348HigSep 14, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.13

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka…

  • CVE-2016-3346HigSep 14, 2016
    Microsoft
    Windows 10 1909
    risk 0.51cvss 7.8epss 0.01

    Microsoft Windows 10 Gold, 1511, and 1607 does not properly enforce permissions, which allows local users to obtain Administrator access via a crafted DLL, aka "Windows Permissions Enforcement Elevation of Privilege Vulnerability."

  • CVE-2016-3345HigSep 14, 2016
    Microsoft
    Windows
    risk 0.59cvss 8.8epss 0.32

    The SMBv1 server in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via crafted packets, aka…

  • CVE-2016-3330HigSep 14, 2016
    Microsoft
    Edge
    risk 0.50cvss 7.5epss 0.14

    Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3294.

  • CVE-2016-3324HigSep 14, 2016
    Microsoft
    Internet Explorer
    risk 0.61cvss 8.8epss 0.28

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2016-3306HigSep 14, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.02

    The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 mishandles session objects, which allows local users to hijack sessions, and…

  • CVE-2016-3305HigSep 14, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.01

    The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 mishandles session objects, which allows local users to hijack sessions, and…

  • CVE-2016-3297HigSep 14, 2016
    Microsoft
    Internet Explorer
    risk 0.59cvss 8.8epss 0.23

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."

  • CVE-2016-3295HigSep 14, 2016
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.15

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."

  • CVE-2016-3294HigSep 14, 2016
    Microsoft
    Edge
    risk 0.50cvss 7.5epss 0.14

    Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3330.

  • CVE-2016-3247HigSep 14, 2016
    Microsoft
    Internet Explorer
    risk 0.56cvss 7.5epss 0.71

    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."

  • CVE-2016-6399HigSep 12, 2016
    Cisco Systems, Inc.
    Application Control Engine Module
    risk 0.49cvss 7.5epss 0.02

    Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service (device reload) via crafted (1) SSL or (2) TLS packets, aka Bug ID CSCvb16317.

  • CVE-2016-6371HigSep 12, 2016
    Cisco Systems, Inc.
    Hosted Collaboration Mediation Fulfillment
    risk 0.49cvss 7.5epss 0.05

    Directory traversal vulnerability in the web interface in Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) 10.6(3) and earlier allows remote attackers to write to arbitrary files via a crafted URL, aka Bug ID CSCuz64717.

  • CVE-2016-7133HigSep 12, 2016
    PHP
    PHP
    risk 0.53cvss 8.1epss 0.04

    Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a long pathname.

  • CVE-2016-7132HigSep 12, 2016
    PHP
    PHP
    risk 0.49cvss 7.5epss 0.09

    ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a…

  • CVE-2016-7131HigSep 12, 2016
    PHP
    PHP
    risk 0.49cvss 7.5epss 0.09

    ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML document that is mishandled in a…

  • CVE-2016-7130HigSep 12, 2016
    PHP
    PHP
    risk 0.49cvss 7.5epss 0.07

    The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as…

  • CVE-2016-7125HigSep 12, 2016
    PHP
    PHP
    risk 0.49cvss 7.5epss 0.06

    ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection.

  • CVE-2016-1469HigSep 12, 2016
    Cisco Systems, Inc.
    SPA300
    risk 0.49cvss 7.5epss 0.02

    The HTTP framework on Cisco SPA300, SPA500, and SPA51x devices allows remote attackers to cause a denial of service (device outage) via a series of malformed HTTP requests, aka Bug ID CSCut67385.

  • CVE-2016-3890HigSep 11, 2016
    Google
    Android SDK
    risk 0.46cvss 7.0epss 0.01

    The Java Debug Wire Protocol (JDWP) implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka…

  • CVE-2016-3887HigSep 11, 2016
    Google
    Android SDK
    risk 0.51cvss 7.8epss 0.00

    providers/settings/SettingsProvider.java in Android 7.0 before 2016-09-01 does not properly enforce the DISALLOW_CONFIG_VPN setting, which allows attackers to bypass an intended always-on VPN state via a crafted application, aka internal bug 29899712.

  • CVE-2016-3885HigSep 11, 2016
    Google
    Android SDK
    risk 0.51cvss 7.8epss 0.01

    debuggerd/debuggerd.cpp in Debuggerd in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles the interaction between PTRACE_ATTACH operations and thread exits, which allows attackers to gain privileges via a crafted…

  • CVE-2016-3874HigSep 11, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.01

    CORE/HDD/src/wlan_hdd_wext.c in the Qualcomm Wi-Fi driver in Android before 2016-09-05 on Nexus 5X devices does not properly validate the arguments array, which allows attackers to gain privileges via a crafted application that sends a WE_UNIT_TEST_CMD command, aka Android…

  • CVE-2016-3873HigSep 11, 2016
    Nvidia
    NVIDIA kernel
    risk 0.51cvss 7.8epss 0.01

    The NVIDIA kernel in Android before 2016-09-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 29518457.

  • CVE-2016-3872HigSep 11, 2016
    Google
    Android SDK
    risk 0.51cvss 7.8epss 0.01

    Buffer overflow in codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows attackers to gain privileges via a crafted application, aka internal bug…

  • CVE-2016-3871HigSep 11, 2016
    Mozilla Corporation
    libstagefright
    risk 0.51cvss 7.8epss 0.01

    Multiple buffer overflows in codecs/mp3dec/SoftMP3.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow attackers to gain privileges via a crafted application, aka…

  • CVE-2016-3870HigSep 11, 2016
    Google
    mediaserver
    risk 0.51cvss 7.8epss 0.01

    omx/SimpleSoftOMXComponent.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 does not prevent input-port changes, which allows attackers to gain privileges via a crafted…

  • CVE-2016-3869HigSep 11, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.01

    The Broadcom Wi-Fi driver in Android before 2016-09-05 on Nexus 5, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, and Pixel C devices allows attackers to gain privileges via a crafted application, aka Android internal bug 29009982 and Broadcom internal bug RB#96070.

  • CVE-2016-3868HigSep 11, 2016
    Google
    Android SDK
    risk 0.51cvss 7.8epss 0.01

    The Qualcomm power driver in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28967028 and Qualcomm internal bug CR1032875.

  • CVE-2016-3867HigSep 11, 2016
    Qualcomm
    IPA driver
    risk 0.51cvss 7.8epss 0.01

    The Qualcomm IPA driver in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28919863 and Qualcomm internal bug CR1037897.

  • CVE-2016-3866HigSep 11, 2016
    Mediatek
    Sound Driver
    risk 0.51cvss 7.8epss 0.00

    The Qualcomm sound driver in Android before 2016-09-05 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28868303 and Qualcomm internal bug CR1032820.

  • CVE-2016-3865HigSep 11, 2016
    Synaptics
    touchscreen driver
    risk 0.51cvss 7.8epss 0.01

    The Synaptics touchscreen driver in Android before 2016-09-05 on Nexus 5X and 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 28799389.

  • CVE-2016-3864HigSep 11, 2016
    Qualcomm
    Radio Interface Layer
    risk 0.51cvss 7.8epss 0.00

    The Qualcomm radio interface layer in Android before 2016-09-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28823714 and Qualcomm internal bug CR913117.

  • CVE-2016-3863HigSep 11, 2016
    Mozilla Corporation
    libstagefright
    risk 0.51cvss 7.8epss 0.01

    Multiple stack-based buffer overflows in the AVCC reassembly implementation in Utils.cpp in libstagefright in MediaMuxer in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow remote attackers to execute…

  • CVE-2016-3862HigSep 11, 2016
    Google
    Android SDK
    risk 0.51cvss 7.8epss 0.02

    media/ExifInterface.java in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 does not properly interact with the use of static variables in libjhead_jni, which allows remote attackers to execute arbitrary code or cause a…

  • CVE-2016-3861HigSep 11, 2016
    Google
    Android
    risk 0.55cvss 7.8epss 0.11

    LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or…

  • CVE-2016-3859HigSep 11, 2016
    Qualcomm
    camera driver
    risk 0.51cvss 7.8epss 0.00

    The Qualcomm camera driver in Android before 2016-09-05 on Nexus 5, 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28815326 and Qualcomm internal bug CR1034641.

  • CVE-2016-3858HigSep 11, 2016
    Qualcomm
    subsystem_restart.c
    risk 0.51cvss 7.8epss 0.01

    Buffer overflow in drivers/soc/qcom/subsystem_restart.c in the Qualcomm subsystem driver in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application that provides a long string, aka Android internal bug 28675151 and…

  • CVE-2016-7395HigSep 11, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    SkPath.cpp in Skia, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, does not properly validate the return values of ChopMonoAtY calls, which allows remote attackers to cause a denial of service (uninitialized memory access and…

  • CVE-2016-5167HigSep 11, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

  • CVE-2016-5161HigSep 11, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties, which allows remote attackers to cause a denial of…

  • CVE-2016-5159HigSep 11, 2016
    Uclouvain
    Openjpeg
    risk 0.57cvss 8.8epss 0.02

    Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via…

  • CVE-2016-5158HigSep 11, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.02

    Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or…

  • CVE-2016-5157HigSep 11, 2016
    Google
    Chrome
    risk 0.58cvss 8.8epss 0.04

    Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to execute arbitrary code via crafted coordinate values in…

  • CVE-2016-5156HigSep 11, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    extensions/renderer/event_bindings.cc in the event bindings in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux attempts to process filtered events after failure to add an event matcher, which allows remote attackers to cause a denial of…

  • CVE-2016-5154HigSep 11, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    Multiple heap-based buffer overflows in PDFium, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JBig2 image.

  • CVE-2016-5153HigSep 11, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    The Web Animations implementation in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, improperly relies on list iteration, which allows remote attackers to cause a denial of service (use-after-destruction) or possibly have…

  • CVE-2016-5152HigSep 11, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.02

    Integer overflow in the opj_tcd_get_decoded_tile_size function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to cause a denial of service (heap-based buffer overflow) or…

  • CVE-2016-5151HigSep 11, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux mishandles timers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted PDF document, related to…