VYPR

CVEs

408,003 total · page 5887 of 8,161

AllCriticalHighKEV
  • CVE-2018-16200HigJan 9, 2019
    Toshiba
    Home gateway HEM-GW16A
    risk 0.57cvss 8.8epss 0.01

    Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to execute arbitrary OS commands.

  • CVE-2018-16199MedJan 9, 2019
    Toshiba
    Home gateway HEM-GW16A
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an remote attacker to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2018-16198HigJan 9, 2019
    Toshiba
    Home gateway HEM-GW16A
    risk 0.57cvss 8.8epss 0.00

    Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier may allow an attacker on the same network segment to access a non-documented developer screen to perform operations on the affected device.

  • CVE-2018-16197MedJan 9, 2019
    Toshiba
    Home gateway HEM-GW16A
    risk 0.42cvss 6.5epss 0.01

    Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to bypass access restriction to access the information and files stored on the affected device.

  • CVE-2018-16196HigJan 9, 2019
    Yokogawa
    Centum Vp Entry
    risk 0.49cvss 7.5epss 0.03

    Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50), CENTUM VP(R4.01.00 - R6.03.10), CENTUM VP Entry Class(R4.01.00 - R6.03.10), Exaopc(R3.10.00 - R3.75.00), PRM(R2.06.00…

  • CVE-2018-16195HigJan 9, 2019
    Aterm
    WF1200CR
    risk 0.57cvss 8.8epss 0.01

    Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands via SOAP interface of UPnP.

  • CVE-2018-16194HigJan 9, 2019
    NEC
    Aterm Wf1200cr Firmware
    risk 0.47cvss 7.2epss 0.01

    Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers to execute arbitrary OS commands via unspecified vectors.

  • CVE-2018-16193MedJan 9, 2019
    Aterm
    WF1200CR
    risk 0.35cvss 5.4epss 0.01

    Cross-site scripting vulnerability in Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2018-16192MedJan 9, 2019
    NEC
    Aterm Wf1200cr Firmware
    risk 0.42cvss 6.5epss 0.01

    Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an attacker on the same network segment to obtain information registered on the device via unspecified vectors.

  • CVE-2018-16191MedJan 9, 2019
    Ec Cube Co.,ltd.
    Ec Cube
    risk 0.33cvss 6.1epss 0.01

    Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC-CUBE 3.0.13,…

  • CVE-2018-16188CriJan 9, 2019
    Ricoh
    Interactive Whiteboard
    risk 0.64cvss 9.8epss 0.02

    SQL injection vulnerability in the RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.3 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions…

  • CVE-2018-16187MedJan 9, 2019
    Ricoh
    Interactive Whiteboard
    risk 0.38cvss 5.9epss 0.01

    The RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.3 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive…

  • CVE-2018-16186HigJan 9, 2019
    Ricoh
    Interactive Whiteboard
    risk 0.57cvss 8.8epss 0.01

    RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard…

  • CVE-2018-16185HigJan 9, 2019
    Ricoh
    Interactive Whiteboard
    risk 0.51cvss 7.8epss 0.01

    RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.1 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard…

  • CVE-2018-16184CriJan 9, 2019
    Ricoh
    Interactive Whiteboard
    risk 0.64cvss 9.8epss 0.04

    RICOH Interactive Whiteboard D2200 V1.6 to V2.2, D5500 V1.6 to V2.2, D5510 V1.6 to V2.2, and the display versions with RICOH Interactive Whiteboard Controller Type1 V1.6 to V2.2 attached (D5520, D6500, D6510, D7500, D8400) allows remote attackers to execute arbitrary commands…

  • CVE-2018-16183HigJan 9, 2019
    Panasonic
    pre-installed applications
    risk 0.51cvss 7.8epss 0.01

    An unquoted search path vulnerability in some pre-installed applications on Panasonic PC run on Windows 7 (32bit), Windows 7 (64bit), Windows 8 (64bit), Windows 8.1 (64bit), Windows 10 (64bit) delivered in or later than October 2009 allow local users to gain privileges via a…

  • CVE-2018-16182HigJan 9, 2019
    MARKET SPEED
    MARKET SPEED
    risk 0.51cvss 7.8epss 0.01

    Untrusted search path vulnerability in the installer of MARKET SPEED Ver.16.4 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  • CVE-2018-16181MedJan 9, 2019
    Daj
    i-FILTER
    risk 0.40cvss 6.1epss 0.01

    HTTP header injection vulnerability in i-FILTER Ver.9.50R05 and earlier may allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks that may result in an arbitrary script injection or setting an arbitrary cookie values via unspecified…

  • CVE-2018-16180MedJan 9, 2019
    Daj
    i-FILTER
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in i-FILTER Ver.9.50R05 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2018-16179MedJan 9, 2019
    Mizuho
    Mizuho Direct App
    risk 0.38cvss 5.9epss 0.01

    The Mizuho Direct App for Android version 3.13.0 and earlier does not verify server certificates, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2018-16178HigJan 9, 2019
    Cybozu
    Garoon
    risk 0.49cvss 7.5epss 0.01

    Cybozu Garoon 3.0.0 to 4.10.0 allows remote attackers to bypass access restriction to view information available only for a sign-on user via Single sign-on function.

  • CVE-2018-16177HigJan 9, 2019
    Ntt West
    Fall Creators Update
    risk 0.51cvss 7.8epss 0.00

    Untrusted search path vulnerability in The installer of Windows 10 Fall Creators Update Modify module for Security Measures tool allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  • CVE-2018-16176HigJan 9, 2019
    Mapping Tool
    Mapping Tool
    risk 0.51cvss 7.8epss 0.01

    Untrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

  • CVE-2018-16175HigJan 9, 2019
    Thimpress
    Learnpress
    risk 0.47cvss 7.2epss 0.01

    SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2018-16174MedJan 9, 2019
    Thimpress
    Learnpress
    risk 0.40cvss 6.1epss 0.01

    Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2018-16173MedJan 9, 2019
    Thimpress
    Learnpress
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2018-16172MedJan 9, 2019
    Cybozu
    Cybozu Remote Service
    risk 0.42cvss 6.5epss 0.01

    Improper countermeasure against clickjacking attack in client certificates management screen was discovered in Cybozu Remote Service 3.0.0 to 3.1.8, that allows remote attackers to trick a user to delete the registered client certificate.

  • CVE-2018-16171HigJan 9, 2019
    Cybozu
    Cybozu Remote Service
    risk 0.57cvss 8.8epss 0.02

    Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 allows remote attackers to execute Java code file on the server via unspecified vectors.

  • CVE-2018-16170HigJan 9, 2019
    Cybozu
    Cybozu Remote Service
    risk 0.53cvss 8.1epss 0.02

    Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 for Windows allows remote authenticated attackers to read arbitrary files via unspecified vectors.

  • CVE-2018-16169HigJan 9, 2019
    Cybozu
    Cybozu Remote Service
    risk 0.57cvss 8.8epss 0.01

    Cybozu Remote Service 3.0.0 to 3.1.0 allows remote authenticated attackers to upload and execute Java code file on the server via unspecified vectors.

  • CVE-2018-16168CriJan 9, 2019
    LogonTracer
    LogonTracer
    risk 0.64cvss 9.8epss 0.02

    LogonTracer 1.2.0 and earlier allows remote attackers to conduct Python code injection attacks via unspecified vectors.

  • CVE-2018-16167CriJan 9, 2019
    LogonTracer
    LogonTracer
    risk 0.73cvss 9.8epss 0.75

    LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

  • CVE-2018-16166HigJan 9, 2019
    Jpcert
    Logontracer
    risk 0.57cvss 8.8epss 0.02

    LogonTracer 1.2.0 and earlier allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.

  • CVE-2018-16165MedJan 9, 2019
    Jpcert
    Logontracer
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in LogonTracer 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2018-16164MedJan 9, 2019
    Web Dorado
    Event Calendar Wd
    risk 0.28cvss 5.4epss 0.01

    Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2018-1000426MedJan 9, 2019
    Jenkins Project
    Git Changelog
    risk 0.40cvss 6.1epss 0.01

    A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPublisher/config.jelly…

  • CVE-2018-1000425HigJan 9, 2019
    Sonarsource
    Sonarqube Scanner
    risk 0.51cvss 7.8epss 0.00

    An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attackers with local file system access to obtain the credentials used to connect to SonarQube.

  • CVE-2018-1000424HigJan 9, 2019
    Jfrog
    Artifactory
    risk 0.44cvss 7.8epss 0.00

    An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it…

  • CVE-2018-1000423HigJan 9, 2019
    Atlassian
    Crowd2
    risk 0.44cvss 7.8epss 0.00

    An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used to connect to Crowd…

  • CVE-2018-1000422MedJan 9, 2019
    Atlassian
    Crowd2
    risk 0.35cvss 6.5epss 0.01

    An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have Jenkins perform a connection test, connecting to an attacker-specified server with attacker-specified credentials and…

  • CVE-2018-1000421MedJan 9, 2019
    Apache
    Mesos
    risk 0.42cvss 6.5epss 0.01

    An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to initiate a test connection to an attacker-specified Mesos server with attacker-specified credentials IDs obtained…

  • CVE-2018-1000420MedJan 9, 2019
    Apache
    Mesos
    risk 0.42cvss 6.5epss 0.01

    An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.

  • CVE-2018-1000419MedJan 9, 2019
    Jenkins Project
    Hipchat Plugin
    risk 0.42cvss 6.5epss 0.02

    An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins.

  • CVE-2018-1000418HigJan 9, 2019
    Atlassian
    Hipchat Server
    risk 0.57cvss 8.8epss 0.01

    An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified credentials IDs obtained…

  • CVE-2018-1000417HigJan 9, 2019
    Jenkins Project
    Email Extension Template
    risk 0.46cvss 8.1epss 0.01

    A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows creating or removing templates.

  • CVE-2018-1000416MedJan 9, 2019
    Jobconfighistory Project
    Jobconfighistory
    risk 0.33cvss 6.1epss 0.01

    A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access.

  • CVE-2018-1000415MedJan 9, 2019
    Rebuild Project
    Rebuild
    risk 0.28cvss 5.4epss 0.01

    A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly, RebuildAction/ExtendedChoiceParameterValue.jelly, RebuildAction/FileParameterValue.jelly, RebuildAction/LabelParameterValue.jelly,…

  • CVE-2018-1000414HigJan 9, 2019
    Jenkins Project
    Config File Provider Plugin
    risk 0.46cvss 8.1epss 0.01

    A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction.java that allows creating and editing configuration file definitions.

  • CVE-2018-1000413MedJan 9, 2019
    Jenkins Project
    Config File Provider Plugin
    risk 0.28cvss 5.4epss 0.01

    A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.

  • CVE-2018-1000412HigJan 9, 2019
    Jenkins Project
    Jira
    risk 0.50cvss 8.8epss 0.01

    An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method,…