VYPR

CVEs

407,936 total · page 5955 of 8,159

AllCriticalHighKEV
  • CVE-2018-0043HigOct 10, 2018
    Juniper Networks
    Junos
    risk 0.57cvss 8.8epss 0.01

    Receipt of a specific MPLS packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execution. By continuously sending specific MPLS packets, an attacker can repeatedly crash the RPD process causing a sustained Denial of Service.…

  • CVE-2018-17925MedOct 10, 2018
    Ge
    Ifix
    risk 0.31cvss 4.8epss 0.00

    Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX object provided to GE iFIX versions 2.0 - 5.8 by Gigasoft. Only the independent use of the Gigasoft charting package outside the iFIX…

  • CVE-2018-13805HigOct 10, 2018
    Siemens Foundation
    SIMATIC ET 200SP Open Controller
    risk 0.49cvss 7.5epss 0.02

    A vulnerability has been identified in SIMATIC ET 200SP Open Controller (All versions >= V2.0 and < V2.1.6), SIMATIC S7-1500 Software Controller (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 incl. F (All versions >= V2.0 and < V2.5). An attacker can cause a…

  • CVE-2018-13802HigOct 10, 2018
    Siemens Foundation
    ROX II
    risk 0.47cvss 7.2epss 0.04

    A vulnerability has been identified in ROX II (All versions < V2.12.1). An authenticated attacker with a high-privileged user account access via SSH could circumvent restrictions in place and execute arbitrary operating system commands. Successful exploitation requires that the…

  • CVE-2018-13801HigOct 10, 2018
    Siemens Foundation
    ROX II
    risk 0.57cvss 8.8epss 0.03

    A vulnerability has been identified in ROX II (All versions < V2.12.1). An attacker with network access to port 22/tcp and valid low-privileged user credentials for the target device could perform a privilege escalation and gain root privileges. Successful exploitation requires…

  • CVE-2018-13800HigOct 10, 2018
    Siemens Foundation
    Simatic S7 1200 V4 Firmware
    risk 0.48cvss 7.3epss 0.01

    A vulnerability has been identified in SIMATIC S7-1200 CPU family version 4 (All versions < V4.2.3). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user…

  • CVE-2018-18211HigOct 10, 2018
    Pbootcmspro
    Pbootcms
    risk 0.53cvss 8.1epss 0.01

    PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI.

  • CVE-2018-18210MedOct 10, 2018
    DiliCMS
    DiliCMS
    risk 0.40cvss 6.1epss 0.01

    XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_url parameter.

  • CVE-2018-18209MedOct 10, 2018
    DiliCMS
    DiliCMS
    risk 0.40cvss 6.1epss 0.01

    XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_type parameter.

  • CVE-2018-18208MedOct 10, 2018
    Virtualmin
    Virtualmin
    risk 0.40cvss 6.1epss 0.01

    Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webmin_search.cgi URI.

  • CVE-2018-18207MedOct 10, 2018
    Virtualmin
    Virtualmin
    risk 0.40cvss 6.1epss 0.01

    Virtualmin 6.03 allows Frame Injection via the settings-editor_read.cgi file parameter.

  • CVE-2018-17919MedOct 10, 2018
    Hangzhou Xiongmai Technology Co., Ltd
    Xmeye P2p Cloud Server
    risk 0.42cvss 6.5epss 0.01

    All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams.

  • CVE-2018-17917MedOct 10, 2018
    Hangzhou Xiongmai Technology Co., Ltd
    Xmeye P2p Cloud Server
    risk 0.35cvss 5.3epss 0.01

    All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs. Using this ID, the attacker can discover and connect to valid devices using one of the supported apps.

  • CVE-2018-17915CriOct 10, 2018
    Hangzhou Xiongmai Technology Co., Ltd
    Xmeye P2p Cloud Server
    risk 0.64cvss 9.8epss 0.01

    All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmware update communication. This could allow an attacker to eavesdrop on video feeds, steal XMeye login credentials, or…

  • CVE-2018-8006MedOct 10, 2018
    Apache
    Activemq
    risk 0.37cvss 6.1epss 0.56

    An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.

  • CVE-2018-15311MedOct 10, 2018
    F5, Inc.
    Big IP
    risk 0.38cvss 5.9epss 0.01

    When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the Large Receive Offload (LRO) feature enabled, TMM may crash, leading to a failover event. This vulnerability is not exposed unless LRO is…

  • CVE-2018-12131HigOct 10, 2018
    Intel
    NVMe
    risk 0.51cvss 7.8epss 0.00

    Permissions in the driver pack installers for Intel NVMe before version 4.0.0.1007 and Intel RSTe before version 4.7.0.2083 may allow an authenticated user to potentially escalate privilege via local access.

  • CVE-2018-8533MedOct 10, 2018
    Microsoft
    SQL Server Management Studio
    risk 0.41cvss 5.5epss 0.23

    An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server…

  • CVE-2018-8532MedOct 10, 2018
    Microsoft
    SQL Server Management Studio
    risk 0.41cvss 5.5epss 0.23

    An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server…

  • CVE-2018-8531HigOct 10, 2018
    Microsoft
    Azure Iot Hub Device Client SDK
    risk 0.58cvss 8.8epss 0.15

    A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka "Azure IoT Device Client SDK Memory Corruption Vulnerability." This affects Hub Device Client SDK, Azure IoT Edge.

  • CVE-2018-8530MedOct 10, 2018
    Microsoft
    Edge
    risk 0.28cvss 4.3epss 0.05

    A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypass Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8512.

  • CVE-2018-8527MedOct 10, 2018
    Microsoft
    SQL Server Management Studio
    risk 0.41cvss 5.5epss 0.23

    An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing a reference to an external entity, aka "SQL Server Management Studio Information Disclosure Vulnerability." This affects SQL Server…

  • CVE-2018-8518MedOct 10, 2018
    Microsoft
    Sharepoint Server
    risk 0.35cvss 5.4epss 0.03

    An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This…

  • CVE-2018-8513HigOct 10, 2018
    Microsoft
    Edge
    risk 0.43cvss 7.5epss 0.14

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503,…

  • CVE-2018-8512MedOct 10, 2018
    Microsoft
    Edge
    risk 0.35cvss 5.4epss 0.03

    A security feature bypass vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents, aka "Microsoft Edge Security Feature Bypass Vulnerability." This affects Microsoft Edge. This CVE ID is…

  • CVE-2018-8511HigOct 10, 2018
    Microsoft
    Edge
    risk 0.43cvss 7.5epss 0.14

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503,…

  • CVE-2018-8510HigOct 10, 2018
    Microsoft
    Edge
    risk 0.43cvss 7.5epss 0.14

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503,…

  • CVE-2018-8509HigOct 10, 2018
    Microsoft
    Edge
    risk 0.50cvss 7.5epss 0.13

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8473.

  • CVE-2018-8506MedOct 10, 2018
    Microsoft
    Windows Server 2019
    risk 0.36cvss 5.5epss 0.04

    An Information Disclosure vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka "Microsoft Windows Codecs Library Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019.

  • CVE-2018-8505HigOct 10, 2018
    Microsoft
    Edge
    risk 0.43cvss 7.5epss 0.14

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503,…

  • CVE-2018-8504HigOct 10, 2018
    Microsoft
    Word
    risk 0.59cvss 8.8epss 0.20

    A remote code execution vulnerability exists in Microsoft Word software when the software fails to properly handle objects in Protected View, aka "Microsoft Word Remote Code Execution Vulnerability." This affects Microsoft SharePoint Server, Office 365 ProPlus, Microsoft Office,…

  • CVE-2018-8503HigOct 10, 2018
    Microsoft
    Edge
    risk 0.43cvss 7.5epss 0.14

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8505,…

  • CVE-2018-8502HigOct 10, 2018
    Microsoft
    Office
    risk 0.59cvss 8.8epss 0.20

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in Protected View, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Excel.

  • CVE-2018-8501HigOct 10, 2018
    Microsoft
    Office
    risk 0.59cvss 8.8epss 0.20

    A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in Protected View, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Office 365 ProPlus, PowerPoint Viewer, Microsoft…

  • CVE-2018-8500CriOct 10, 2018
    Microsoft
    Chakracore
    risk 0.58cvss 9.8epss 0.18

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore.

  • CVE-2018-8498MedOct 10, 2018
    Microsoft
    Sharepoint Server
    risk 0.35cvss 5.4epss 0.02

    An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This…

  • CVE-2018-8497HigOct 10, 2018
    Microsoft
    Windows Server 2016
    risk 0.51cvss 7.8epss 0.01

    An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers.

  • CVE-2018-8495HigOct 10, 2018
    Microsoft
    Windows Server 2016
    risk 0.53cvss 7.5epss 0.51

    A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

  • CVE-2018-8494HigOct 10, 2018
    Microsoft
    Windows Server 2008
    risk 0.59cvss 8.8epss 0.22

    A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019,…

  • CVE-2018-8493HigOct 10, 2018
    Microsoft
    Windows Server 2012
    risk 0.49cvss 7.5epss 0.08

    An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka "Windows TCP/IP Information Disclosure Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10,…

  • CVE-2018-8492MedOct 10, 2018
    Microsoft
    Windows Server 2016
    risk 0.35cvss 5.3epss 0.02

    A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10,…

  • CVE-2018-8491HigOct 10, 2018
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.13

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 11. This CVE ID is unique from CVE-2018-8460.

  • CVE-2018-8490HigOct 10, 2018
    Microsoft
    Windows Server 2016
    risk 0.55cvss 8.4epss 0.04

    A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10,…

  • CVE-2018-8489HigOct 10, 2018
    Microsoft
    Windows Server 2008
    risk 0.55cvss 8.4epss 0.04

    A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2,…

  • CVE-2018-8488MedOct 10, 2018
    Microsoft
    Sharepoint Server
    risk 0.35cvss 5.4epss 0.02

    An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This…

  • CVE-2018-8486MedOct 10, 2018
    Microsoft
    Windows Server 2008
    risk 0.36cvss 5.5epss 0.02

    An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012,…

  • CVE-2018-8484HigOct 10, 2018
    Microsoft
    Windows Server 2012
    risk 0.51cvss 7.8epss 0.01

    An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012,…

  • CVE-2018-8482LowOct 10, 2018
    Microsoft
    Windows Server 2008
    risk 0.21cvss 3.1epss 0.05

    An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server…

  • CVE-2018-8481LowOct 10, 2018
    Microsoft
    Windows Server 2008
    risk 0.21cvss 3.1epss 0.05

    An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server…

  • CVE-2018-8480MedOct 10, 2018
    Microsoft
    Sharepoint Server
    risk 0.35cvss 5.4epss 0.02

    An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This…