VYPR

CVEs

31,808 total · page 591 of 637

AllCriticalHighKEV
  • CVE-2016-3511HigJul 21, 2016
    Sun Corporation
    Java Se
    risk 0.50cvss 7.7epss 0.01

    Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Deployment.

  • CVE-2016-3506HigJul 21, 2016
    Oracle Corporation
    JDBC
    risk 0.53cvss 8.1epss 0.04

    Unspecified vulnerability in the JDBC component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2; the Oracle Retail Xstore Point of Service 5.5, 6.0, 6.5, 7.0, 7.1, 15.0, and 16.0; the Oracle Retail Warehouse Management System 14.04, 14.1.3, and 15.0.1; the Oracle…

  • CVE-2016-3503HigJul 21, 2016
    Sun Corporation
    Java Se
    risk 0.50cvss 7.7epss 0.01

    Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 allows local users to affect confidentiality, integrity, and availability via vectors related to Install.

  • CVE-2016-3491HigJul 21, 2016
    Oracle Corporation
    CRM Technical Foundation
    risk 0.53cvss 8.2epss 0.03

    Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Wireless Framework. NOTE: the previous information is from the July 2016 CPU.…

  • CVE-2016-3487HigJul 21, 2016
    Oracle Corporation
    Webcenter Sites
    risk 0.53cvss 8.1epss 0.05

    Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 11.1.1.8, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2016-3483HigJul 21, 2016
    Oracle Corporation
    Peoplesoft Enterprise Peopletools
    risk 0.47cvss 7.2epss 0.03

    Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote attackers to affect confidentiality and availability via vectors related to File Processing.

  • CVE-2016-3481HigJul 21, 2016
    Oracle Corporation
    Sun Systems Products Suite
    risk 0.50cvss 7.7epss 0.03

    Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote authenticated users to affect availability via vectors related to Web.

  • CVE-2016-3479HigJul 21, 2016
    Oracle Corporation
    Database Server
    risk 0.49cvss 7.5epss 0.04

    Unspecified vulnerability in the Portable Clusterware component in Oracle Database Server 11.2.0.4 and 12.1.0.2 allows remote attackers to affect availability via unknown vectors.

  • CVE-2016-3477HigJul 21, 2016
    MariaDB
    MariaDB
    risk 0.53cvss 8.1epss 0.00

    Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows local users to affect confidentiality, integrity, and availability via vectors related to…

  • CVE-2016-3471HigJul 21, 2016
    MariaDB
    MariaDB
    risk 0.49cvss 7.5epss 0.00

    Unspecified vulnerability in Oracle MySQL 5.5.45 and earlier and 5.6.26 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Option.

  • CVE-2016-3470HigJul 21, 2016
    Oracle Corporation
    Transportation Management
    risk 0.46cvss 7.1epss 0.02

    Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.4.1 allows remote authenticated users to affect confidentiality and integrity via vectors related to Install.

  • CVE-2016-3446HigJul 21, 2016
    Oracle Corporation
    Business Intelligence
    risk 0.54cvss 8.3epss 0.02

    Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Analytics Web Administration.

  • CVE-2016-3440HigJul 21, 2016
    Oracle Corporation
    MySQL
    risk 0.50cvss 7.7epss 0.03

    Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer.

  • CVE-2016-0635HigJul 21, 2016
    Oracle Corporation
    Primavera P6 Enterprise Project Portfolio Management
    risk 0.58cvss 8.8epss 0.05

    Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component in Oracle Health Sciences Applications 1.2.8.3, 2.0.2.3, and 3.0.1.0; the…

  • CVE-2016-5654HigJul 19, 2016
    Misys
    Fusioncapital Opics Plus
    risk 0.49cvss 7.5epss 0.02

    Misys FusionCapital Opics Plus allows remote authenticated users to gain privileges via a man-in-the-middle attack that modifies the xmlMessageOut parameter.

  • CVE-2015-8947HigJul 19, 2016
    Harfbuzz Project
    Harfbuzz
    risk 0.42cvss 7.6epss 0.02

    hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2016-2052.

  • CVE-2016-5388HigJul 19, 2016
    risk 0.50cvss 8.1epss 0.51

    Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote…

  • CVE-2016-5387HigJul 19, 2016
    Apache
    HTTP Server
    risk 0.56cvss 8.1epss 0.56

    The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP…

  • CVE-2016-5386HigJul 19, 2016
    Go
    net/http
    risk 0.56cvss 8.1epss 0.05

    The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to…

  • CVE-2016-5385HigJul 19, 2016
    PHP
    PHP
    risk 0.59cvss 8.1epss 0.50

    PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an…

  • CVE-2016-3039HigJul 17, 2016
    IBM
    Traveler
    risk 0.53cvss 8.1epss 0.02

    IBM Traveler 8.x and 9.x before 9.0.1.12 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity…

  • CVE-2016-1448HigJul 17, 2016
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 2.7 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuy92706.

  • CVE-2016-5661HigJul 15, 2016
    Accela
    Civic Platform Citizen Access
    risk 0.58cvss 8.8epss 0.03

    Accela Civic Platform Citizen Access portal relies on the client to restrict file types for uploads, which allows remote authenticated users to execute arbitrary code via modified _EventArgument and filename parameters.

  • CVE-2016-5637HigJul 15, 2016
    Libbpg Project
    Libbpg
    risk 0.57cvss 8.8epss 0.03

    The restore_tqb_pixels function in libbpg 0.9.5 through 0.9.7 mishandles the transquant_bypass_enable_flag value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted BPG image, related to a "type confusion"…

  • CVE-2016-0340HigJul 15, 2016
    IBM
    Security Identity Manager Adapter
    risk 0.48cvss 7.4epss 0.01

    IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session expiration, which allows remote attackers to hijack sessions by leveraging an unattended workstation.

  • CVE-2016-0330HigJul 15, 2016
    IBM
    Security Identity Manager Adapter
    risk 0.47cvss 7.3epss 0.01

    IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles password creation, which makes it easier for remote attackers to obtain access by leveraging an attack against the password algorithm.

  • CVE-2015-1977HigJul 15, 2016
    IBM
    Tivoli Directory Server
    risk 0.49cvss 7.5epss 0.02

    Directory traversal vulnerability in the Web Administration tool in IBM Tivoli Directory Server (ITDS) before 6.1.0.74-ISS-ISDS-IF0074, 6.2.x before 6.2.0.50-ISS-ISDS-IF0050, and 6.3.x before 6.3.0.43-ISS-ISDS-IF0043 and IBM Security Directory Server (ISDS) before…

  • CVE-2016-5807HigJul 15, 2016
    Enghousenetworks
    Lighthouse Sms
    risk 0.53cvss 8.1epss 0.01

    Tollgrade LightHouse SMS before 5.1 patch 3 allows remote authenticated users to bypass an intended administrative-authentication requirement, and read or change parameter values, via a direct request.

  • CVE-2016-5790HigJul 15, 2016
    Enghousenetworks
    Lighthouse Sms
    risk 0.49cvss 7.5epss 0.03

    Tollgrade LightHouse SMS before 5.1 patch 3 allows remote attackers to bypass authentication and restart the software via unspecified vectors.

  • CVE-2016-4529HigJul 15, 2016
    Schneider Electric
    SoMachine HVAC Programming Software
    risk 0.48cvss 7.3epss 0.05

    An unspecified ActiveX control in Schneider Electric SoMachine HVAC Programming Software for M171/M172 Controllers before 2.1.0 allows remote attackers to execute arbitrary code via unknown vectors, related to the INTERFACESAFE_FOR_UNTRUSTED_CALLER (aka safe for scripting) flag.

  • CVE-2016-1456HigJul 15, 2016
    Cisco Systems, Inc.
    iOS Xr
    risk 0.51cvss 7.8epss 0.00

    The CLI in Cisco IOS XR 6.x through 6.0.1 allows local users to execute arbitrary OS commands in a privileged context by leveraging unspecified container access, aka Bug ID CSCuz62721.

  • CVE-2016-1450HigJul 15, 2016
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.49cvss 7.5epss 0.01

    Cisco WebEx Meetings Server 2.6 allows remote authenticated users to conduct command-injection attacks via vectors related to an upload's file type, aka Bug ID CSCuy92715.

  • CVE-2016-1446HigJul 15, 2016
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.57cvss 8.8epss 0.02

    SQL injection vulnerability in Cisco WebEx Meetings Server 2.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuy83200.

  • CVE-2016-1426HigJul 15, 2016
    Cisco Systems, Inc.
    iOS Xr
    risk 0.49cvss 7.5epss 0.02

    Cisco IOS XR 5.x through 5.2.5 on NCS 6000 devices allows remote attackers to cause a denial of service (timer consumption and Route Processor reload) via crafted SSH traffic, aka Bug ID CSCux76819.

  • CVE-2016-5821HigJul 13, 2016
    Huawei
    Hisuite
    risk 0.51cvss 7.8epss 0.00

    Huawei HiSuite before 4.0.4.204_ove (Out of China) and before 4.0.4.301 (China) use a weak ACL (FILE_WRITE_DATA for BUILTIN\Users) for the HiSuite service directory, which allows local users to gain SYSTEM privileges via a Trojan horse (1) SspiCli.dll or (2) USERENV.dll file or…

  • CVE-2016-4974HigJul 13, 2016
    risk 0.49cvss 7.5epss 0.06

    Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary…

  • CVE-2016-4066HigJul 13, 2016
    Fortinet
    Fortiweb
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Fortinet FortiWeb before 5.5.3 allows remote attackers to hijack the authentication of administrators for requests that change the password via unspecified vectors.

  • CVE-2016-3100HigJul 13, 2016
    KDE
    Kde Frameworks
    risk 0.55cvss 8.4epss 0.00

    kinit in KDE Frameworks before 5.23.0 uses weak permissions (644) for /tmp/xauth-xxx-_y, which allows local users to obtain X11 cookies of other users and consequently capture keystrokes and possibly gain privileges by reading the file.

  • CVE-2016-4255HigJul 13, 2016
    Adobe Inc.
    Acrobat
    risk 0.57cvss 8.8epss 0.05

    Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allows attackers to execute arbitrary code via unspecified…

  • CVE-2016-4249HigJul 13, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.58cvss 8.8epss 0.07

    Heap-based buffer overflow in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors.

  • CVE-2016-4248HigJul 13, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.58cvss 8.8epss 0.07

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4173,…

  • CVE-2016-4246HigJul 13, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-4245HigJul 13, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-4244HigJul 13, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-4243HigJul 13, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-4242HigJul 13, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-4241HigJul 13, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-4240HigJul 13, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-4239HigJul 13, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-4238HigJul 13, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…