VYPR

CVEs

31,842 total · page 586 of 637

AllCriticalHighKEV
  • CVE-2016-4656HigKEVAug 25, 2016
    Apple Inc.
    iOS
    risk 0.71cvss 7.8epss 0.24

    The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-4069HigAug 25, 2016
    Roundcube
    Webmail
    risk 0.57cvss 8.8epss 0.03

    Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors.

  • CVE-2016-7089HigAug 24, 2016
    Rapidstream
    Rapidstream
    risk 0.54cvss 7.8epss 0.01

    WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command, aka ESCALATEPLOWMAN.

  • CVE-2016-5650HigAug 24, 2016
    Zmodo
    Zp Ibh 13w
    risk 0.49cvss 7.5epss 0.02

    ZModo ZP-NE14-S and ZP-IBH-13W devices do not enforce a WPA2 configuration setting, which allows remote attackers to trigger association with an arbitrary access point by using a recognized SSID value.

  • CVE-2016-5645HigAug 24, 2016
    Rockwellautomation
    Micrologix
    risk 0.49cvss 7.3epss 0.29

    Rockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA, and 1766-L32BXBA devices have a hardcoded SNMP community, which makes it easier for remote attackers to load arbitrary firmware updates by leveraging knowledge of this…

  • CVE-2016-6364HigAug 23, 2016
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.49cvss 7.5epss 0.02

    The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified API calls, aka Bug ID CSCux67855.

  • CVE-2016-6355HigAug 23, 2016
    Cisco Systems, Inc.
    iOS Xr
    risk 0.49cvss 7.5epss 0.03

    Memory leak in Cisco IOS XR 5.1.x through 5.1.3, 5.2.x through 5.2.5, and 5.3.x through 5.3.2 on ASR 9001 devices allows remote attackers to cause a denial of service (control-plane protocol outage) via crafted fragmented packets, aka Bug ID CSCux26791.

  • CVE-2016-1484HigAug 23, 2016
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.49cvss 7.5epss 0.02

    Cisco WebEx Meetings Server 2.6 allows remote attackers to bypass intended access restrictions and obtain sensitive application information via unspecified vectors, aka Bug ID CSCuy92724.

  • CVE-2016-6362HigAug 22, 2016
    Cisco Systems, Inc.
    Aironet 1800
    risk 0.51cvss 7.8epss 0.00

    Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.110.0, 8.2.12x before 8.2.121.0, and 8.3.x before 8.3.102.0 allow local users to gain privileges via crafted CLI parameters, aka Bug ID CSCuz24725.

  • CVE-2016-4377HigAug 22, 2016
    HPE
    Smart Update in Storage Sizing Tool
    risk 0.54cvss 8.1epss 0.07

    HPE Smart Update in Storage Sizing Tool before 13.0, Converged Infrastructure Solution Sizer Suite (CISSS) before 2.13.1, Power Advisor before 7.8.2, Insight Management Sizer before 16.12.1, Synergy Planning Tool before 3.3, SAP Sizing Tool before 16.12.1, Sizing Tool for SAP…

  • CVE-2016-1479HigAug 22, 2016
    Cisco Systems, Inc.
    IP Phone 8800
    risk 0.49cvss 7.5epss 0.03

    Cisco IP Phone 8800 devices with software 11.0(1) allow remote attackers to cause a denial of service (memory corruption) via a crafted HTTP request, aka Bug ID CSCuz03038.

  • CVE-2016-0915HigAug 22, 2016
    EMC Corporation
    Rsa Authentication Manager
    risk 0.53cvss 8.1epss 0.02

    The Self-Service Portal in EMC RSA Authentication Manager (AM) Prime Self-Service 3.0 and 3.1 before 3.1 1915.42871 allows remote authenticated users to cause a denial of service (PIN change for an arbitrary user) via a modified token serial number within a PIN change request,…

  • CVE-2016-5736HigAug 19, 2016
    F5, Inc.
    Big IP
    risk 0.49cvss 7.5epss 0.02

    The default configuration of the IPsec IKE peer listener in F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.1 before HF16, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1, and 12.x before 12.0.0 HF2; BIG-IP AAM, AFM, and PEM 11.4.x, 11.5.x before 11.5.4 HF2,…

  • CVE-2016-4475HigAug 19, 2016
    Theforeman
    Foreman
    risk 0.57cvss 8.8epss 0.03

    The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified…

  • CVE-2016-0760HigAug 19, 2016
    Apache
    Sentry
    risk 0.57cvss 8.8epss 0.03

    Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2) reflect2, or (3) java_method Hive builtin functions.

  • CVE-2015-8022HigAug 19, 2016
    F5, Inc.
    Big IP
    risk 0.49cvss 7.5epss 0.03

    The Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, and Link Controller 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP AAM 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before…

  • CVE-2016-4654HigAug 18, 2016
    Apple Inc.
    iOS
    risk 0.51cvss 7.8epss 0.01

    IOMobileFrameBuffer in Apple iOS before 9.3.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-1458HigAug 18, 2016
    Cisco Systems, Inc.
    Secure Firewall Management Center
    risk 0.57cvss 8.8epss 0.02

    The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.0.3, 5.3.1.x before 5.3.1.2, and 5.4.x before 5.4.0.1 and Cisco Adaptive Security Appliance (ASA) Software on 5500-X devices with FirePOWER Services 4.x and 5.x before 5.3.0.3, 5.3.1.x before 5.3.1.2,…

  • CVE-2016-1457HigAug 18, 2016
    Cisco Systems, Inc.
    Adaptive Security Appliance (ASA) Software on 5500-X devices with FirePOWER Services
    risk 0.57cvss 8.8epss 0.04

    The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 and Cisco Adaptive Security Appliance (ASA) Software on 5500-X devices with FirePOWER Services 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 allows remote…

  • CVE-2016-1365HigAug 18, 2016
    Cisco Systems, Inc.
    Application Policy Infrastructure Controller Enterprise Module
    risk 0.57cvss 8.8epss 0.03

    The Grapevine update process in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0 allows remote authenticated users to execute arbitrary commands as root via a crafted upgrade parameter, aka Bug ID CSCux15507.

  • CVE-2016-6367HigKEVAug 18, 2016
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.67cvss 7.8epss 0.23

    Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

  • CVE-2016-6366HigKEVAug 18, 2016
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.79cvss 8.8epss 0.88

    Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted…

  • CVE-2016-5384HigAug 13, 2016
    Fontconfig Project
    Fontconfig
    risk 0.51cvss 7.8epss 0.00

    fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.

  • CVE-2016-6597HigAug 10, 2016
    Sophos
    EAS Proxy
    risk 0.56cvss 8.6epss 0.04

    Sophos EAS Proxy before 6.2.0 for Sophos Mobile Control, when Lotus Traveler is enabled, allows remote attackers to access arbitrary web-resources from the backend mail system via a request for the resource, aka an Open Reverse Proxy vulnerability.

  • CVE-2016-5421HigAug 10, 2016
    Curl
    Libcurl
    risk 0.53cvss 8.1epss 0.08

    Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.

  • CVE-2016-5420HigAug 10, 2016
    Curl
    Libcurl
    risk 0.49cvss 7.5epss 0.15

    curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

  • CVE-2016-5419HigAug 10, 2016
    Curl
    Curl
    risk 0.49cvss 7.5epss 0.15

    curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.

  • CVE-2016-3322HigAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.51cvss 7.5epss 0.14

    Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3289.

  • CVE-2016-3319HigAug 9, 2016
    Microsoft
    Windows Server 2012
    risk 0.48cvss 7.0epss 0.19

    The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote Code Execution Vulnerability."

  • CVE-2016-3318HigAug 9, 2016
    Microsoft
    Office
    risk 0.53cvss 7.8epss 0.22

    Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allow remote attackers to execute arbitrary code via a crafted file, aka "Graphics Component Memory Corruption Vulnerability."

  • CVE-2016-3317HigAug 9, 2016
    Microsoft
    Word
    risk 0.53cvss 7.8epss 0.22

    Microsoft Office 2010 SP2, Word 2007 SP3, Word 2010 SP2, Word for Mac 2011, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-3316HigAug 9, 2016
    Microsoft
    Word
    risk 0.58cvss 7.8epss 0.47

    Microsoft Word 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-3313HigAug 9, 2016
    Microsoft
    Office
    risk 0.58cvss 7.8epss 0.50

    Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-3311HigAug 9, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.02

    The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka…

  • CVE-2016-3310HigAug 9, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.03

    The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka…

  • CVE-2016-3309HigKEVAug 9, 2016
    Microsoft
    Windows
    risk 0.75cvss 7.8epss 0.21

    The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka…

  • CVE-2016-3308HigAug 9, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.06

    The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka…

  • CVE-2016-3304HigAug 9, 2016
    Microsoft
    Office
    risk 0.58cvss 7.8epss 0.51

    The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers…

  • CVE-2016-3303HigAug 9, 2016
    Microsoft
    Office
    risk 0.58cvss 7.8epss 0.51

    The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers…

  • CVE-2016-3301HigAug 9, 2016
    Microsoft
    Office
    risk 0.58cvss 7.8epss 0.44

    The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync…

  • CVE-2016-3300HigAug 9, 2016
    Microsoft
    Windows Server 2012
    risk 0.51cvss 7.8epss 0.01

    The Netlogon service in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 improperly establishes secure communications channels, which allows local users to gain privileges by leveraging access to a domain-joined machine, aka "Netlogon Elevation of…

  • CVE-2016-3296HigAug 9, 2016
    Microsoft
    Edge
    risk 0.51cvss 7.5epss 0.15

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."

  • CVE-2016-3293HigAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.15

    Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulnerability."

  • CVE-2016-3290HigAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.16

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code via a crafted web page, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3288.

  • CVE-2016-3289HigAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.18

    Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3322.

  • CVE-2016-3288HigAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.54cvss 7.5epss 0.52

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code via a crafted web page, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3290.

  • CVE-2016-3237HigAug 9, 2016
    Microsoft
    Windows
    risk 0.54cvss 7.5epss 0.17

    Kerberos in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows man-in-the-middle attackers to bypass authentication via vectors related to a…

  • CVE-2016-5330HigAug 8, 2016
    VMware
    Workstation
    risk 0.56cvss 7.8epss 0.18

    Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMware Workstation Player 12.1.x before 12.1.1, and VMware Fusion 8.1.x before 8.1.1 allows local…

  • CVE-2016-2875HigAug 8, 2016
    IBM
    QRadar SIEM
    risk 0.57cvss 8.8epss 0.02

    IBM Security QRadar SIEM 7.1.x and 7.2.x before 7.2.7 allows remote authenticated users to execute arbitrary OS commands as root via unspecified vectors.

  • CVE-2016-6486HigAug 8, 2016
    Siemens Foundation
    Sinema Server
    risk 0.51cvss 7.8epss 0.00

    Siemens SINEMA Server uses weak permissions for the application folder, which allows local users to gain privileges via unspecified vectors.