VYPR

CVEs

31,398 total · page 615 of 628

AllCriticalHighKEV
  • CVE-2015-8027HigJan 2, 2016
    Node.js
    Node.js
    risk 0.49cvss 7.5epss 0.01

    Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.

  • CVE-2015-7430HigJan 2, 2016
    Apache
    Hadoop
    risk 0.55cvss 8.4epss 0.00

    The Hadoop connector 1.1.1, 2.4, 2.5, and 2.7.0-0 before 2.7.0-3 for IBM Spectrum Scale and General Parallel File System (GPFS) allows local users to read or write to arbitrary GPFS data via unspecified vectors.

  • CVE-2015-7407HigJan 2, 2016
    IBM
    Mashups Center
    risk 0.57cvss 8.8epss 0.00

    Cross-site request forgery (CSRF) vulnerability in Lotus Mashups in IBM Mashup Center 3.0.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

  • CVE-2015-7400HigJan 2, 2016
    IBM
    Mashups Center
    risk 0.50cvss 7.7epss 0.01

    The Lotus Mashups component in IBM Mashup Center 3.0.0.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

  • CVE-2015-2023HigJan 2, 2016
    IBM
    I Access
    risk 0.60cvss 8.8epss 0.00

    Buffer overflow in IBM i Access 7.1 on Windows allows local users to gain privileges via unspecified vectors.

  • CVE-2015-7442HigJan 2, 2016
    IBM
    Installation Manager
    risk 0.46cvss 7.0epss 0.00

    consoleinst.sh in IBM Installation Manager before 1.7.4.4 and 1.8.x before 1.8.4 and Packaging Utility before 1.7.4.4 and 1.8.x before 1.8.4 allows local users to gain privileges via a Trojan horse program that is located in /tmp with a name based on a predicted PID value.

  • CVE-2015-7429HigJan 2, 2016
    IBM
    Spectrum Protect For Virtual Environments
    risk 0.55cvss 8.5epss 0.00

    The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 7.1 before 7.1.4 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 4.1…

  • CVE-2015-5018HigJan 2, 2016
    IBM
    Security Access Manager For Web 8.0 Firmware
    risk 0.52cvss 8.0epss 0.01

    IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute arbitrary OS commands by leveraging Local Management Interface (LMI) access.

  • CVE-2015-7410HigJan 1, 2016
    IBM
    Sterling B2b Integrator
    risk 0.48cvss 7.4epss 0.00

    The Health Check tool in IBM Sterling B2B Integrator 5.2 does not properly use cookies in conjunction with HTTPS sessions, which allows man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.

  • CVE-2015-7489HigJan 1, 2016
    IBM
    Spss Statistics
    risk 0.51cvss 7.8epss 0.00

    IBM SPSS Statistics 22.0.0.2 before IF10 and 23.0.0.2 before IF7 uses weak permissions (Everyone: Write) for Python scripts, which allows local users to gain privileges by modifying a script.

  • CVE-2015-5990HigDec 31, 2015
    Belkin
    F9K1102
    risk 0.57cvss 8.8epss 0.00

    Cross-site request forgery (CSRF) vulnerability on Belkin F9K1102 2 devices with firmware 2.10.17 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2015-5987HigDec 31, 2015
    Belkin
    F9K1102
    risk 0.56cvss 8.6epss 0.01

    Belkin F9K1102 2 devices with firmware 2.10.17 use an improper algorithm for selecting the ID value in the header of a DNS query, which makes it easier for remote attackers to spoof responses by predicting this value.

  • CVE-2015-1947HigDec 31, 2015
    IBM
    Infosphere Biginsights
    risk 0.48cvss 7.4epss 0.00

    Untrusted search path vulnerability in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0, when a DB2 database is used, allows local users to gain privileges via a Trojan horse library that is loaded by a setuid or setgid program.

  • CVE-2015-7284HigDec 31, 2015
    Zyxel
    Nbg 418n Firmware
    risk 0.52cvss 8.0epss 0.00

    Cross-site request forgery (CSRF) vulnerability on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2015-7283HigDec 31, 2015
    Zyxel
    Nbg 418n Firmware
    risk 0.53cvss 8.1epss 0.01

    The web administration interface on ZyXEL NBG-418N devices with firmware 1.00(AADZ.3)C0 has a default password of 1234 for the admin account, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.

  • CVE-2015-7281HigDec 31, 2015
    Readynet Solutions
    Wrt300n Dd Firmware
    risk 0.57cvss 8.8epss 0.00

    Cross-site request forgery (CSRF) vulnerability on ReadyNet WRT300N-DD devices with firmware 1.0.26 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2015-7278HigDec 31, 2015
    Amped Wireless
    R10000
    risk 0.57cvss 8.8epss 0.00

    Cross-site request forgery (CSRF) vulnerability on Amped Wireless R10000 devices with firmware 2.5.2.11 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2015-6020HigDec 31, 2015
    Zyxel
    PMG5318-B20A
    risk 0.52cvss 8.0epss 0.00

    ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 allow remote authenticated users to obtain administrative privileges by leveraging access to the user account.

  • CVE-2015-6019HigDec 31, 2015
    Zyxel
    PMG5318-B20A
    risk 0.55cvss 8.5epss 0.00

    The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.

  • CVE-2015-5996HigDec 31, 2015
    Mediabridge
    Medialink Mwn Wapr300n Firmware
    risk 0.60cvss 8.8epss 0.00

    Cross-site request forgery (CSRF) vulnerability on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2015-2912HigDec 31, 2015
    Orientdb
    Orientdb
    risk 0.57cvss 8.8epss 0.00

    The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information,…

  • CVE-2015-2895HigDec 31, 2015
    Idera
    Uptime Infrastructure Monitor
    risk 0.48cvss 7.3epss 0.06

    Buffer overflow in the up.time client in Idera Uptime Infrastructure Monitor 7.4 might allow remote attackers to execute arbitrary code via long command input.

  • CVE-2015-2876HigDec 31, 2015
    Seagate
    Wireless Mobile Storage
    risk 0.57cvss 8.8epss 0.01

    Unrestricted file upload vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to execute arbitrary code by uploading a file to /media/sda2…

  • CVE-2015-2875HigDec 31, 2015
    Seagate
    Wireless Mobile Storage
    risk 0.49cvss 7.5epss 0.02

    Absolute path traversal vulnerability on Seagate GoFlex Satellite, Seagate Wireless Mobile Storage, Seagate Wireless Plus Mobile Storage, and LaCie FUEL devices with firmware before 3.4.1.105 allows remote attackers to read arbitrary files via a full pathname in a download…

  • CVE-2014-3260HigDec 31, 2015
    Pacom
    Rtu Gms
    risk 0.49cvss 7.5epss 0.00

    Pacom 1000 CCU and RTU GMS devices allow remote attackers to spoof the controller-to-base data stream by leveraging improper use of cryptography.

  • CVE-2015-7788HigDec 30, 2015
    Asus
    Wl 330nul Firmware
    risk 0.48cvss 7.3epss 0.01

    ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to execute arbitrary commands via unspecified vectors.

  • CVE-2015-7250HigDec 30, 2015
    Zte
    Zxhn H108n R1a Firmware
    risk 0.53cvss 7.5epss 0.20

    Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.

  • CVE-2015-7248HigDec 30, 2015
    Zte
    Zxhn H108n R1a Firmware
    risk 0.55cvss 7.5epss 0.35

    ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703.

  • CVE-2015-5663HigDec 30, 2015
    Rarlab
    Winrar
    risk 0.48cvss 7.4epss 0.00

    The file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain privileges via a Trojan horse file with a name similar to an extensionless filename that was selected by the user.

  • CVE-2015-8467HigDec 29, 2015
    Samba (software)
    Samba
    risk 0.49cvss 7.5epss 0.02

    The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote…

  • CVE-2015-7540HigDec 29, 2015
    Samba (software)
    Samba
    risk 0.51cvss 7.5epss 0.23

    The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.

  • CVE-2015-5330HigDec 29, 2015
    Samba (software)
    Samba
    risk 0.49cvss 7.5epss 0.02

    ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, mishandles string lengths, which allows remote attackers to obtain sensitive information from daemon heap memory by sending crafted packets and then reading…

  • CVE-2015-5252HigDec 29, 2015
    Samba (software)
    Samba
    risk 0.48cvss 7.2epss 0.18

    vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.

  • CVE-2015-8651HigKEVDec 28, 2015
    Adobe Inc.
    Air
    risk 0.76cvss 8.8epss 0.89

    Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to…

  • CVE-2015-8650HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.57cvss 8.8epss 0.03

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…

  • CVE-2015-8649HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.57cvss 8.8epss 0.03

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…

  • CVE-2015-8648HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.57cvss 8.8epss 0.03

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…

  • CVE-2015-8647HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.57cvss 8.8epss 0.03

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…

  • CVE-2015-8646HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.58cvss 8.8epss 0.05

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…

  • CVE-2015-8645HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.58cvss 8.8epss 0.07

    Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code…

  • CVE-2015-8644HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.64cvss 8.8epss 0.47

    Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code…

  • CVE-2015-8643HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.58cvss 8.8epss 0.05

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…

  • CVE-2015-8642HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.58cvss 8.8epss 0.05

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…

  • CVE-2015-8641HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.58cvss 8.8epss 0.05

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…

  • CVE-2015-8640HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.58cvss 8.8epss 0.05

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…

  • CVE-2015-8639HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.57cvss 8.8epss 0.03

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…

  • CVE-2015-8638HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.57cvss 8.8epss 0.03

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…

  • CVE-2015-8636HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.63cvss 8.8epss 0.40

    Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code…

  • CVE-2015-8635HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.64cvss 8.8epss 0.47

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…

  • CVE-2015-8634HigDec 28, 2015
    Adobe Inc.
    Air
    risk 0.64cvss 8.8epss 0.47

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows…