VYPR

CVEs

31,424 total · page 610 of 629

AllCriticalHighKEV
  • CVE-2016-1927HigFeb 20, 2016
    PhpMyAdmin
    phpMyAdmin
    risk 0.42cvss 7.5epss 0.01

    The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.

  • CVE-2016-1335HigFeb 19, 2016
    Cisco Systems, Inc.
    Staros
    risk 0.49cvss 7.5epss 0.03

    The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication configuration, which allows remote authenticated users to gain privileges by establishing a connection from an endpoint…

  • CVE-2016-0069HigFeb 18, 2016
    Microsoft
    Internet Explorer
    risk 0.60cvss 8.8epss 0.38

    Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0068.

  • CVE-2016-0068HigFeb 18, 2016
    Microsoft
    Internet Explorer
    risk 0.60cvss 8.8epss 0.35

    Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0069.

  • CVE-2015-8150HigFeb 18, 2016
    Symantec
    Encryption Management Server
    risk 0.51cvss 7.8epss 0.00

    Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file.

  • CVE-2015-8149HigFeb 18, 2016
    Symantec
    Encryption Management Server
    risk 0.49cvss 7.5epss 0.01

    The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to cause a denial of service (heap memory corruption and service outage) via crafted requests.

  • CVE-2015-8148HigFeb 18, 2016
    Symantec
    Encryption Management Server
    risk 0.49cvss 7.5epss 0.00

    The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about administrator accounts via a modified request.

  • CVE-2016-0795HigFeb 18, 2016
    Libreoffice
    Libreoffice
    risk 0.51cvss 7.8epss 0.01

    LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document.

  • CVE-2016-0794HigFeb 18, 2016
    Libreoffice
    Libreoffice
    risk 0.51cvss 7.8epss 0.00

    The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document.

  • CVE-2015-7547HigFeb 18, 2016
    GNU
    Glibc
    risk 0.63cvss 8.1epss 0.94

    Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS…

  • CVE-2016-0773HigFeb 17, 2016
    PostgreSQL
    PostgreSQL
    risk 0.50cvss 7.5epss 0.11

    PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 allows remote attackers to cause a denial of service (infinite loop or buffer overflow and crash) via a large Unicode character range in a regular expression.

  • CVE-2016-0766HigFeb 17, 2016
    PostgreSQL
    PostgreSQL
    risk 0.57cvss 8.8epss 0.01

    PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.

  • CVE-2016-1151HigFeb 17, 2016
    Cybozu
    Office
    risk 0.57cvss 8.8epss 0.00

    Multiple cross-site request forgery (CSRF) vulnerabilities in Cybozu Office 9.9.0 through 10.3.0 allow remote attackers to hijack the authentication of arbitrary users.

  • CVE-2015-8483HigFeb 17, 2016
    Cybozu
    Office
    risk 0.48cvss 7.4epss 0.00

    Open redirect vulnerability in Cybozu Office 10.2.0 through 10.3.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.

  • CVE-2016-2389HigFeb 16, 2016
    SAP
    Netweaver
    risk 0.58cvss 7.5epss 0.84

    Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security…

  • CVE-2016-0752HigKEVFeb 16, 2016
    Rubyonrails
    Rails
    risk 0.64cvss 7.5epss 0.90

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render…

  • CVE-2016-0751HigFeb 16, 2016
    Rubyonrails
    Rails
    risk 0.42cvss 7.5epss 0.09

    actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a…

  • CVE-2015-7581HigFeb 16, 2016
    Rubyonrails
    Rails
    risk 0.49cvss 7.5epss 0.09

    actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard…

  • CVE-2016-0742HigFeb 15, 2016
    Nginx
    Nginx
    risk 0.55cvss 7.5epss 0.79

    The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.

  • CVE-2015-7472HigFeb 15, 2016
    IBM
    Websphere Portal
    risk 0.47cvss 7.2epss 0.00

    IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF10 allows remote attackers to conduct LDAP injection attacks, and consequently read or write to repository data, via unspecified…

  • CVE-2015-5050HigFeb 15, 2016
    IBM
    Emptoris Contract Management
    risk 0.57cvss 8.8epss 0.00

    Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to hijack the…

  • CVE-2015-5042HigFeb 15, 2016
    IBM
    Emptoris Contract Management
    risk 0.49cvss 7.5epss 0.01

    IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote attackers to execute arbitrary code by including a crafted Flash file.

  • CVE-2015-5012HigFeb 15, 2016
    IBM
    Security Access Manager For Web 8.0 Firmware
    risk 0.49cvss 7.5epss 0.00

    The SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the set of MAC algorithms, which makes it easier for remote attackers to defeat cryptographic protection…

  • CVE-2015-5010HigFeb 15, 2016
    IBM
    Security Access Manager For Web 8.0 Firmware
    risk 0.49cvss 7.5epss 0.00

    IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.

  • CVE-2015-4956HigFeb 15, 2016
    IBM
    QRadar SIEM
    risk 0.48cvss 7.4epss 0.00

    The Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to execute unspecified OS commands via unknown vectors.

  • CVE-2016-1627HigFeb 14, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    The Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access…

  • CVE-2016-1624HigFeb 14, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli…

  • CVE-2016-1623HigFeb 14, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.02

    The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to…

  • CVE-2016-1622HigFeb 14, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.defineProperty method to override intended extension behavior, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.

  • CVE-2016-1949HigFeb 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.57cvss 8.8epss 0.00

    Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a…

  • CVE-2016-1526HigFeb 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.53cvss 8.1epss 0.01

    The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of…

  • CVE-2016-1525HigFeb 13, 2016
    Netgear
    Management System NMS300
    risk 0.65cvss 8.6epss 0.80

    Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. (dot dot) in the realName parameter.

  • CVE-2016-1522HigFeb 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.57cvss 8.8epss 0.02

    Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly…

  • CVE-2016-1521HigFeb 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.57cvss 8.8epss 0.01

    The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive…

  • CVE-2016-0865HigFeb 13, 2016
    Enghousenetworks
    Smartgrid Lighthouse Sensor Management System
    risk 0.57cvss 8.8epss 0.00

    Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote authenticated users to change arbitrary passwords via unspecified vectors.

  • CVE-2016-0863HigFeb 13, 2016
    Enghousenetworks
    Smartgrid Lighthouse Sensor Management System
    risk 0.57cvss 8.8epss 0.00

    Cross-site request forgery (CSRF) vulnerability in Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2015-8630HigFeb 13, 2016
    Mit
    Kerberos 5
    risk 0.42cvss 7.5epss 0.04

    The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer…

  • CVE-2016-2330HigFeb 12, 2016
    FFmpeg
    Ffmpeg
    risk 0.57cvss 8.8epss 0.01

    libavcodec/gif.c in FFmpeg before 2.8.6 does not properly calculate a buffer size, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .tga file, related to the gif_image_write_image,…

  • CVE-2016-2329HigFeb 12, 2016
    FFmpeg
    Ffmpeg
    risk 0.57cvss 8.8epss 0.01

    libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr chrominance subsampling factors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF…

  • CVE-2016-2328HigFeb 12, 2016
    FFmpeg
    Ffmpeg
    risk 0.57cvss 8.8epss 0.01

    libswscale/swscale_unscaled.c in FFmpeg before 2.8.6 does not validate certain height values, which allows remote attackers to cause a denial of service (out-of-bounds array read access) or possibly have unspecified other impact via a crafted .cine file, related to the…

  • CVE-2016-2327HigFeb 12, 2016
    FFmpeg
    Ffmpeg
    risk 0.57cvss 8.8epss 0.01

    libavcodec/pngenc.c in FFmpeg before 2.8.5 uses incorrect line sizes in certain row calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .avi file, related to the…

  • CVE-2016-2326HigFeb 12, 2016
    FFmpeg
    Ffmpeg
    risk 0.57cvss 8.8epss 0.01

    Integer overflow in the asf_write_packet function in libavformat/asfenc.c in FFmpeg before 2.8.5 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PTS (aka presentation timestamp) value in a .mov file.

  • CVE-2016-1322HigFeb 12, 2016
    Cisco Systems, Inc.
    Spark
    risk 0.49cvss 7.5epss 0.00

    The REST interface in Cisco Spark 2015-07-04 allows remote attackers to bypass intended access restrictions and create arbitrary user accounts via unspecified web requests, aka Bug ID CSCuv72584.

  • CVE-2016-1315HigFeb 12, 2016
    Cisco Systems, Inc.
    Email Security Appliance Firmeware
    risk 0.49cvss 7.5epss 0.00

    The proxy engine in Cisco Advanced Malware Protection (AMP), when used with Email Security Appliance (ESA) 9.5.0-201, 9.6.0-051, and 9.7.0-125, allows remote attackers to bypass intended content restrictions via a malformed e-mail message containing an encoded file, aka Bug ID…

  • CVE-2016-0985HigFeb 10, 2016
    Adobe Inc.
    Air SDK
    risk 0.65cvss 8.8epss 0.59

    Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code…

  • CVE-2016-0984HigKEVFeb 10, 2016
    Adobe Inc.
    Air SDK
    risk 0.78cvss 8.8epss 0.67

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows…

  • CVE-2016-0983HigFeb 10, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.07

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows…

  • CVE-2016-0982HigFeb 10, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.13

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows…

  • CVE-2016-0981HigFeb 10, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.06

    Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code…

  • CVE-2016-0980HigFeb 10, 2016
    Adobe Inc.
    Air SDK
    risk 0.57cvss 8.8epss 0.03

    Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code…