VYPR

CVEs

407,927 total · page 5983 of 8,159

AllCriticalHighKEV
  • CVE-2018-16710CriSep 7, 2018
    Octoprint
    Octoprint
    risk 0.59cvss 9.1epss 0.02

    OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081. NOTE: the vendor disputes the significance of this report because their documentation states that with "blind port forwarding ... Putting…

  • CVE-2018-16709CriSep 7, 2018
    Fujixerox
    DocuCentre-V 3065
    risk 0.64cvss 9.8epss 0.02

    Fuji Xerox DocuCentre-V 3065, ApeosPort-VI C3371, ApeosPort-V C4475, ApeosPort-V C3375, DocuCentre-VI C2271, ApeosPort-V C5576, DocuCentre-IV C2263, DocuCentre-V C2263, and ApeosPort-V 5070 devices allow remote attackers to read or write to files via crafted PJL commands.

  • CVE-2018-16460CriSep 7, 2018
    Umbraengineering
    Ps
    risk 0.64cvss 9.8epss 0.03

    A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.

  • CVE-2018-16704MedSep 7, 2018
    Gleeztech
    Gleezcms
    risk 0.28cvss 4.3epss 0.01

    An issue was discovered in Gleez CMS v1.2.0. Because of an Insecure Direct Object Reference vulnerability, it is possible for attackers (logged in users) to view profile page of other users, as demonstrated by navigating to user/3 on demo.gleezcms.org.

  • CVE-2018-16703MedSep 7, 2018
    Gleez
    CMS
    risk 0.35cvss 5.3epss 0.02

    A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help an attacker to perform login attempts in excess of the configured login attempt limit. The vulnerability is due to…

  • CVE-2018-16667HigSep 7, 2018
    Contiki OS
    Contiki
    risk 0.46cvss 7.0epss 0.00

    An issue was discovered in Contiki-NG through 4.1. There is a buffer over-read in lookup in os/storage/antelope/lvm.c while parsing AQL (lvm_register_variable, lvm_set_variable_value, create_intersection, create_union).

  • CVE-2018-16666HigSep 7, 2018
    Contiki OS
    Contiki
    risk 0.51cvss 7.8epss 0.00

    An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in next_string in os/storage/antelope/aql-lexer.c while parsing AQL (parsing next string).

  • CVE-2018-16665MedSep 7, 2018
    Contiki OS
    Contiki
    risk 0.40cvss 6.1epss 0.00

    An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow while parsing AQL in lvm_shift_for_operator in os/storage/antelope/lvm.c.

  • CVE-2018-16664HigSep 7, 2018
    Contiki OS
    Contiki
    risk 0.46cvss 7.0epss 0.00

    An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow in lvm_set_type in os/storage/antelope/lvm.c while parsing AQL (lvm_set_op, lvm_set_relation, lvm_set_operand).

  • CVE-2018-16663HigSep 7, 2018
    Contiki OS
    Contiki
    risk 0.51cvss 7.8epss 0.00

    An issue was discovered in Contiki-NG through 4.1. There is a stack-based buffer overflow in parse_relations in os/storage/antelope/aql-parser.c while parsing AQL (storage of relations).

  • CVE-2016-9044HigSep 7, 2018
    Information Builders
    WebFOCUS Business Intelligence Portal
    risk 0.58cvss 8.8epss 0.04

    An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1 . A specially crafted web parameter can cause a command injection. An authenticated attacker can send a crafted web request to trigger this vulnerability.

  • CVE-2017-2795HigSep 7, 2018
    Marklogic
    Marklogic
    risk 0.54cvss 8.3epss 0.01

    An exploitable heap corruption vulnerability exists in the Txo functionality of Antenna House DMC HTMLFilter as used by MarkLogic 8.0-6. A specially crafted xls file can cause a heap corruption resulting in arbitrary code execution. An attacker can send/provide malicious XLS…

  • CVE-2017-2792HigSep 7, 2018
    Marklogic
    Marklogic
    risk 0.54cvss 8.3epss 0.01

    An exploitable heap corruption vulnerability exists in the iBldDirInfo functionality of Antenna House DMC HTMLFilter used by MarkLogic 8.0-6. A specially crafted xls file can cause a heap corruption resulting in arbitrary code execution. An attacker can provide a malicious xls…

  • CVE-2018-4010HigSep 7, 2018
    Protonvpn
    ProtonVPN
    risk 0.51cvss 7.8epss 0.05

    An exploitable code execution vulnerability exists in the connect functionality of ProtonVPN VPN client 1.5.1. A specially crafted configuration file can cause a privilege escalation, resulting in the ability to execute arbitrary commands with the system's privileges.

  • CVE-2018-3952HigSep 7, 2018
    Nordvpn
    Nordvpn
    risk 0.57cvss 8.8epss 0.01

    An exploitable code execution vulnerability exists in the connect functionality of NordVPN 6.14.28.0. A specially crafted configuration file can cause a privilege escalation, resulting in the execution of arbitrary commands with system privileges.

  • CVE-2018-1789HigSep 7, 2018
    IBM
    API Connect
    risk 0.55cvss 8.4epss 0.01

    IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.

  • CVE-2018-1757MedSep 7, 2018
    IBM
    Security Identity Governance And Intelligence
    risk 0.35cvss 5.3epss 0.02

    IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive information due to missing authentication in IGI for the survey application. IBM X-Force ID: 148601.

  • CVE-2018-1756HigSep 7, 2018
    IBM
    Security Identity Governance And Intelligence
    risk 0.53cvss 7.5epss 0.11

    IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, information in the back-end database. IBM X-Force ID: 148599.

  • CVE-2018-1567CriSep 7, 2018
    IBM
    Websphere Application Server
    risk 0.64cvss 9.8epss 0.04

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through the SOAP connector with a serialized object from untrusted sources. IBM X-Force ID: 143024.

  • CVE-2017-1115MedSep 7, 2018
    IBM
    Campaign
    risk 0.35cvss 5.4epss 0.01

    IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 121153.

  • CVE-2017-1114MedSep 7, 2018
    IBM
    Campaign
    risk 0.35cvss 5.4epss 0.01

    IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…

  • CVE-2018-16658MedSep 7, 2018
    Linux
    Kernel
    risk 0.40cvss 6.1epss 0.01

    An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to…

  • CVE-2018-16657CriSep 7, 2018
    Kamailio
    Kamailio
    risk 0.64cvss 9.8epss 0.04

    In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation fault and crashes Kamailio. The reason is missing input validation in the crcitt_string_array core function for calculating a CRC hash for To tags. (An…

  • CVE-2018-0663HigSep 7, 2018
    I-O DATA
    Ts Wrla Firmware
    risk 0.57cvss 8.8epss 0.02

    Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) use hardcoded credentials which may allow an remote authenticated attacker to execute arbitrary OS commands…

  • CVE-2018-0662MedSep 7, 2018
    I-O DATA
    Ts Wrla Firmware
    risk 0.44cvss 6.8epss 0.00

    Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) allow an attacker on the same network segment to add malicious files on the device and execute arbitrary…

  • CVE-2018-0661HigSep 7, 2018
    I-O DATA
    Ts Wrla Firmware
    risk 0.57cvss 8.8epss 0.01

    Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) allow an attacker on the same network segment to bypass access restriction to add files on a specific…

  • CVE-2018-0660LowSep 7, 2018
    Hibara
    Attachecase
    risk 0.22cvss 3.3epss 0.01

    Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create arbitrary files via specially crafted ATC file.

  • CVE-2018-0659MedSep 7, 2018
    Hibara
    Attachecase
    risk 0.36cvss 5.5epss 0.01

    Directory traversal vulnerability in ver.2.8.4.0 and earlier and ver.3.3.0.0 and earlier allows an attacker to create or overwrite existing files via specially crafted ATC file.

  • CVE-2018-0658HigSep 7, 2018
    GMO-PG
    Payment Module (PG Multi-Payment Service)
    risk 0.47cvss 7.2epss 0.01

    Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, GMO-PG Payment Module (PG Multi-Payment Service)…

  • CVE-2018-0657MedSep 7, 2018
    GMO-PG
    Payment Module (PG Multi-Payment Service)
    risk 0.31cvss 4.8epss 0.01

    Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG…

  • CVE-2018-0655MedSep 7, 2018
    Weseek
    Growi
    risk 0.31cvss 4.8epss 0.01

    Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page.

  • CVE-2018-0654MedSep 7, 2018
    Weseek
    Growi
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the modal for creating Wiki page.

  • CVE-2018-0653MedSep 7, 2018
    Weseek
    Growi
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote attackers to inject arbitrary web script or HTML via Wiki page view.

  • CVE-2018-0652MedSep 7, 2018
    Weseek
    Growi
    risk 0.31cvss 4.8epss 0.01

    Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page.

  • CVE-2018-0650HigSep 7, 2018
    Linecorp
    Line Music
    risk 0.48cvss 7.4epss 0.01

    The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2018-0649HigSep 7, 2018
    Eset
    Nod32 Antivirus
    risk 0.51cvss 7.8epss 0.01

    Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Security, ESET Smart Security, ESET NOD32 Antivirus, DESlock+ Pro, and CompuSec (all programs except packaged ones)) allows an…

  • CVE-2018-0648HigSep 7, 2018
    Chatwork
    Chatwork
    risk 0.51cvss 7.8epss 0.01

    Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  • CVE-2018-0647HigSep 7, 2018
    Asus
    Wl 330nul Firmware
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

  • CVE-2018-0645CriSep 7, 2018
    Bit Part
    Mtappjquery
    risk 0.64cvss 9.8epss 0.02

    MTAppjQuery 1.8.1 and earlier allows remote PHP code execution via unspecified vectors.

  • CVE-2018-0644MedSep 7, 2018
    Canonical
    Ubuntu Linux
    risk 0.42cvss 6.5epss 0.01

    Buffer overflow in Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-client2) 1:1.4.9+p41-u4jma1 and earlier, Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 5.0.0 (panda-client2) 1:2.0.0+p48-u4jma1 and earlier, and Ubuntu16.04 ORCA (Online Receipt Computer…

  • CVE-2018-0643MedSep 7, 2018
    ORCA
    ORCA
    risk 0.43cvss 6.6epss 0.01

    Ubuntu14.04 ORCA (Online Receipt Computer Advantage) 4.8.0 (panda-server) 1:1.4.9+p41-u4jma1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.

  • CVE-2018-0642MedSep 7, 2018
    Foliovision
    Fv Flowplayer Video Player
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in FV Flowplayer Video Player 6.1.2 to 6.6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2018-0624HigSep 7, 2018
    Yayoi
    Kaikei 17 Series
    risk 0.51cvss 7.8epss 0.01

    Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and earlier, Yayoi Kyuuyo 17 Ver.20.1.4 and earlier, Yayoi Kyuuyo Keisan 17 Ver.20.1.4 and earlier, Yayoi Hanbai 17 Series…

  • CVE-2018-0623HigSep 7, 2018
    Yayoi
    Yayoi 17 Series
    risk 0.51cvss 7.8epss 0.01

    Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and earlier, Yayoi Kyuuyo 17 Ver.20.1.4 and earlier, Yayoi Kyuuyo Keisan 17 Ver.20.1.4 and earlier, Yayoi Hanbai 17 Series…

  • CVE-2016-9040MedSep 7, 2018
    Joyent
    Smartos
    risk 0.36cvss 5.5epss 0.00

    An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when used with a 32 bit model. An attacker can cause a buffer to be allocated and…

  • CVE-2018-16655MedSep 7, 2018
    Gxlcms
    Gxlcms
    risk 0.40cvss 6.1epss 0.01

    Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.

  • CVE-2018-16654MedSep 7, 2018
    Zurmo
    Zurmo CRM
    risk 0.40cvss 6.1epss 0.01

    Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.

  • CVE-2018-16653MedSep 7, 2018
    rejucms
    rejucms
    risk 0.40cvss 6.1epss 0.01

    rejucms 2.1 has XSS via the ucenter/cms_user_add.php u_name parameter.

  • CVE-2018-16651HigSep 7, 2018
    PhpMyAdmin
    Phpmyfaq
    risk 0.47cvss 7.2epss 0.01

    The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.

  • CVE-2018-16650HigSep 7, 2018
    PhpMyAdmin
    Phpmyfaq
    risk 0.57cvss 8.8epss 0.01

    phpMyFAQ before 2.9.11 allows CSRF.