VYPR

CVEs

31,424 total · page 606 of 629

AllCriticalHighKEV
  • CVE-2016-1351HigMar 26, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.02

    The Locator/ID Separation Protocol (LISP) implementation in Cisco IOS 15.1 and 15.2 and NX-OS 4.1 through 6.2 allows remote attackers to cause a denial of service (device reload) via a crafted header in a packet, aka Bug ID CSCuu64279.

  • CVE-2016-1350HigMar 26, 2016
    Cisco Systems, Inc.
    iOS Xe
    risk 0.49cvss 7.5epss 0.02

    Cisco IOS 15.3 and 15.4, Cisco IOS XE 3.8 through 3.11, and Cisco Unified Communications Manager allow remote attackers to cause a denial of service (device reload) via malformed SIP messages, aka Bug ID CSCuj23293.

  • CVE-2016-1349HigMar 26, 2016
    Cisco Systems, Inc.
    iOS Xe
    risk 0.49cvss 7.5epss 0.01

    The Smart Install client implementation in Cisco IOS 12.2, 15.0, and 15.2 and IOS XE 3.2 through 3.7 allows remote attackers to cause a denial of service (device reload) via crafted image list parameters in a Smart Install packet, aka Bug ID CSCuv45410.

  • CVE-2016-1348HigMar 26, 2016
    Cisco Systems, Inc.
    iOS Xe
    risk 0.49cvss 7.5epss 0.01

    Cisco IOS 15.0 through 15.5 and IOS XE 3.3 through 3.16 allow remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 Relay message, aka Bug ID CSCus55821.

  • CVE-2016-1347HigMar 24, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.04

    The Wide Area Application Services (WAAS) Express implementation in Cisco IOS 15.1 through 15.5 allows remote attackers to cause a denial of service (device reload) via a crafted TCP segment, aka Bug ID CSCuq59708.

  • CVE-2016-0636HigMar 24, 2016
    Sun Corporation
    Java Se
    risk 0.54cvss 8.1epss 0.13

    Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Hotspot sub-component.

  • CVE-2016-1783HigMar 24, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2016-1778HigMar 24, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.01

    WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2016-1777HigMar 24, 2016
    Apple Inc.
    Mac OS X Server
    risk 0.49cvss 7.5epss 0.00

    Web Server in Apple OS X Server before 5.1 supports the RC4 algorithm, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.

  • CVE-2016-1775HigMar 24, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.01

    TrueTypeScaler in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file.

  • CVE-2016-1769HigMar 24, 2016
    Apple Inc.
    Quicktime
    risk 0.54cvss 7.8epss 0.05

    QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Photoshop file.

  • CVE-2016-1768HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.54cvss 7.8epss 0.09

    QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix image, a different vulnerability than CVE-2016-1767.

  • CVE-2016-1767HigMar 24, 2016
    Apple Inc.
    Quicktime
    risk 0.54cvss 7.8epss 0.05

    QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix image, a different vulnerability than CVE-2016-1768.

  • CVE-2016-1766HigMar 24, 2016
    Apple Inc.
    iOS
    risk 0.49cvss 7.5epss 0.00

    The Profiles component in Apple iOS before 9.3 does not properly validate certificates, which allows attackers to spoof an MDM profile trust relationship via unspecified vectors.

  • CVE-2016-1765HigMar 24, 2016
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.00

    otool in Apple Xcode before 7.3 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.

  • CVE-2016-1762HigMar 24, 2016
    Xmlsoft
    Libxml2
    risk 0.46cvss 8.1epss 0.02

    The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

  • CVE-2016-1759HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.00

    The kernel in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-1757HigMar 24, 2016
    Apple Inc.
    iOS
    risk 0.53cvss 7.0epss 0.51

    Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context via a crafted app.

  • CVE-2016-1756HigMar 24, 2016
    Apple Inc.
    iOS
    risk 0.51cvss 7.8epss 0.00

    The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

  • CVE-2016-1755HigMar 24, 2016
    Apple Inc.
    tvOS
    risk 0.54cvss 7.8epss 0.05

    The kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1754.

  • CVE-2016-1754HigMar 24, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.01

    The kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1755.

  • CVE-2016-1753HigMar 24, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.00

    Multiple integer overflows in the kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allow attackers to execute arbitrary code in a privileged context via a crafted app.

  • CVE-2016-1751HigMar 24, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.00

    The kernel in Apple iOS before 9.3, tvOS before 9.2, and watchOS before 2.2 does not properly restrict the execute permission, which allows attackers to bypass a code-signing protection mechanism via a crafted app.

  • CVE-2016-1750HigMar 24, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.01

    Use-after-free vulnerability in the kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to execute arbitrary code in a privileged context via a crafted app.

  • CVE-2016-1749HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.54cvss 7.8epss 0.03

    IOUSBFamily in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-1747HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.00

    IOGraphics in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1746.

  • CVE-2016-1746HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.00

    IOGraphics in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1747.

  • CVE-2016-1744HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.54cvss 7.8epss 0.03

    The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1743.

  • CVE-2016-1743HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.54cvss 7.8epss 0.03

    The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1744.

  • CVE-2016-1740HigMar 24, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.02

    FontParser in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document.

  • CVE-2016-1738HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.00

    dyld in Apple OS X before 10.11.4 allows attackers to bypass a code-signing protection mechanism via a modified app.

  • CVE-2016-1736HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.00

    Bluetooth in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1735.

  • CVE-2016-1735HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.00

    Bluetooth in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1736.

  • CVE-2016-1733HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.00

    AppleRAID in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2015-7551HigMar 24, 2016
    Ruby Lang
    Ruby
    risk 0.48cvss 8.4epss 0.00

    The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or…

  • CVE-2016-2281HigMar 18, 2016
    Abb
    Panel Builder 800
    risk 0.47cvss 7.2epss 0.00

    Untrusted search path vulnerability in ABB Panel Builder 800 5.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory.

  • CVE-2015-8154HigMar 18, 2016
    Symantec
    Endpoint Protection
    risk 0.57cvss 8.8epss 0.02

    The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows remote attackers to execute arbitrary code via a crafted HTML document, related to "RWX Permissions."

  • CVE-2015-8153HigMar 18, 2016
    Symantec
    Endpoint Protection Manager
    risk 0.57cvss 8.8epss 0.01

    SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2015-8152HigMar 18, 2016
    Symantec
    Endpoint Protection Manager
    risk 0.52cvss 8.0epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script.

  • CVE-2014-9768HigMar 18, 2016
    IBM
    Tivoli Netview Access Services
    risk 0.57cvss 8.8epss 0.01

    IBM Tivoli NetView Access Services (NVAS) allows remote authenticated users to gain privileges by entering the ADM command and modifying a "page ID" field to the EMSPG2 transaction code. NOTE: the vendor's perspective is that configuration and use of available security controls…

  • CVE-2016-1996HigMar 18, 2016
    Microfocus
    System Management Homepage
    risk 0.50cvss 7.7epss 0.00

    HPE System Management Homepage before 7.5.4 allows local users to obtain sensitive information or modify data via unspecified vectors.

  • CVE-2016-1993HigMar 18, 2016
    Microfocus
    System Management Homepage
    risk 0.53cvss 8.1epss 0.00

    HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.

  • CVE-2016-2342HigMar 17, 2016
    Quagga (software)
    Quagga
    risk 0.47cvss 8.1epss 0.20

    The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute…

  • CVE-2016-1991HigMar 16, 2016
    Arubanetworks
    ArcSight ESM
    risk 0.52cvss 8.0epss 0.00

    HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to conduct unspecified "file download" attacks via unknown vectors.

  • CVE-2016-1990HigMar 16, 2016
    Arubanetworks
    ArcSight ESM
    risk 0.51cvss 7.8epss 0.00

    HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows local users to gain privileges for command execution via unspecified vectors.

  • CVE-2016-2856HigMar 14, 2016
    Debian
    Debian Linux
    risk 0.58cvss 8.4epss 0.01

    pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS; and the glibc package before 2.21-0ubuntu4.2 on Ubuntu 15.10 and before 2.23-0ubuntu1 on Ubuntu…

  • CVE-2016-1645HigMar 13, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.02

    Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allow remote attackers to cause a denial of service (incorrect cast and out-of-bounds write) or possibly have unspecified…

  • CVE-2016-1644HigMar 13, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.02

    WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly restrict relayout scheduling, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted…

  • CVE-2016-1643HigMar 13, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.02

    The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly maintain the user agent shadow DOM, which allows remote attackers to cause a denial of service or…

  • CVE-2016-2802HigMar 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.57cvss 8.8epss 0.01

    The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via…