VYPR

CVEs

404,335 total · page 6226 of 8,087

AllCriticalHighKEV
  • CVE-2017-15879HigOct 24, 2017
    Keystonejs
    Keystone
    risk 0.61cvss 8.8epss 0.07

    CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.

  • CVE-2017-15878MedOct 24, 2017
    Keystonejs
    Keystone
    risk 0.43cvss 6.1epss 0.03

    A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.

  • CVE-2017-1583HigOct 24, 2017
    IBM
    Liberty
    risk 0.49cvss 7.5epss 0.03

    IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.13)could allow a remote attacker to obtain sensitive information caused by improper error handling by MyFaces in JSF.

  • CVE-2017-1523HigOct 24, 2017
    IBM
    Infosphere Master Data Management
    risk 0.49cvss 7.5epss 0.02

    IBM InfoSphere Master Data Management - Collaborative Edition 11.5 could allow an unauthorized user to download reports without authentication. IBM X-Force ID: 129892.

  • CVE-2017-1375HigOct 24, 2017
    IBM
    Storwize Unified V7000
    risk 0.49cvss 7.5epss 0.01

    IBM System Storage Storwize V7000 Unified (V7000U) 1.5 and 1.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126868.

  • CVE-2017-1212MedOct 24, 2017
    IBM
    Daeja Viewone
    risk 0.42cvss 6.5epss 0.01

    IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to a denial of service when viewing or opening a large file. IBM X-Force ID: 123852.

  • CVE-2017-1211LowOct 24, 2017
    IBM
    Daeja Viewone
    risk 0.16cvss 2.5epss 0.00

    IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could disclose sensitive information to a local user when logging is enabled. IBM X-Force ID: 123851.

  • CVE-2017-1210HigOct 24, 2017
    IBM
    Daeja Viewone
    risk 0.49cvss 7.5epss 0.01

    IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files made to look legitimate. IBM X-Force ID: 123850.

  • CVE-2017-1209MedOct 24, 2017
    IBM
    Daeja Viewone
    risk 0.35cvss 5.4epss 0.01

    IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…

  • CVE-2016-3049MedOct 24, 2017
    IBM
    Openpages Grc Platform
    risk 0.35cvss 5.4epss 0.01

    IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 114712.

  • CVE-2017-15874MedOct 24, 2017
    Busybox
    Busybox
    risk 0.33cvss 5.0epss 0.01

    archival/libarchive/decompress_unlzma.c in BusyBox 1.27.2 has an Integer Underflow that leads to a read access violation.

  • CVE-2017-15873MedOct 24, 2017
    Busybox
    Busybox
    risk 0.36cvss 5.5epss 0.01

    The get_next_block function in archival/libarchive/decompress_bunzip2.c in BusyBox 1.27.2 has an Integer Overflow that may lead to a write access violation.

  • CVE-2017-15872MedOct 24, 2017
    Phpwcms
    Phpwcms
    risk 0.31cvss 4.8epss 0.01

    phpwcms 1.8.9 has XSS in include/inc_tmpl/admin.edituser.tmpl.php and include/inc_tmpl/admin.newuser.tmpl.php via the username (aka new_login) field.

  • CVE-2017-15871HigOct 24, 2017
    Serialize To Js Project
    Serialize To Js
    risk 0.49cvss 7.5epss 0.01

    The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function()" substring, as demonstrated by a "function(){console.log(" call or a simple infinite loop. NOTE:…

  • CVE-2017-15867MedOct 24, 2017
    WordPress
    User Login History
    risk 0.40cvss 6.1epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) date_from, (2) date_to, (3) user_id, (4) username, (5) country_name, (6) browser, (7)…

  • CVE-2017-15863MedOct 24, 2017
    WordPress
    wp-noexternallinks
    risk 0.40cvss 6.1epss 0.01

    Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.

  • CVE-2016-10517HigOct 24, 2017
    Redis
    Redis
    risk 0.41cvss 7.4epss 0.02

    networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).

  • CVE-2017-15223MedOct 24, 2017
    Argosoft
    Mini Mail Server
    risk 0.38cvss 5.3epss 0.05

    Denial-of-service vulnerability in ArGoSoft Mini Mail Server 1.0.0.2 and earlier allows remote attackers to waste CPU resources (memory consumption) via unspecified vectors, possibly triggering an infinite loop.

  • CVE-2017-15222CriOct 24, 2017
    Ayukov
    NFTPD
    risk 0.72cvss 9.8epss 0.60

    Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.

  • CVE-2017-15186MedOct 24, 2017
    FFmpeg
    Ffmpeg
    risk 0.42cvss 6.5epss 0.02

    Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.

  • CVE-2017-14696HigOct 24, 2017
    Saltstack
    Salt
    risk 0.42cvss 7.5epss 0.04

    SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.

  • CVE-2017-14695CriOct 24, 2017
    Saltstack
    Salt
    risk 0.57cvss 9.8epss 0.03

    Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability…

  • CVE-2015-5173HigOct 24, 2017
    Cloudfoundry
    Uaa
    risk 0.57cvss 8.8epss 0.01

    Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."

  • CVE-2015-5172CriOct 24, 2017
    Cloudfoundry
    Uaa
    risk 0.57cvss 9.8epss 0.01

    Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.

  • CVE-2015-5171CriOct 24, 2017
    Cloudfoundry
    Uaa
    risk 0.57cvss 9.8epss 0.01

    The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.

  • CVE-2015-5170HigOct 24, 2017
    Cloudfoundry
    Uaa
    risk 0.50cvss 8.8epss 0.01

    Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF…

  • CVE-2013-3734MedOct 24, 2017
    JBoss
    Jboss Application Server
    risk 0.43cvss 6.6epss 0.02

    The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2) attackers to obtain…

  • CVE-2014-1203CriOct 24, 2017
    Eyou Mail System
    Eyou
    risk 0.65cvss 9.8epss 0.16

    The get_login_ip_config_file function in Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/ip_login_set/d_ip_login_get.php.

  • CVE-2014-0691HigOct 24, 2017
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.48cvss 7.3epss 0.01

    Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass authentication and join arbitrary meetings without a password, aka Bug ID CSCuc79643.

  • CVE-2017-15081CriOct 24, 2017
    Phpsugar
    PHP Melody
    risk 0.67cvss 9.8epss 0.02

    In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.

  • CVE-2017-12618MedOct 24, 2017
    Apache
    Portable Runtime Utility
    risk 0.31cvss 4.7epss 0.01

    Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using…

  • CVE-2017-12613HigOct 24, 2017
    Apache
    Portable Runtime
    risk 0.39cvss 7.1epss 0.02

    When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a…

  • CVE-2017-13683MedOct 23, 2017
    Symantec
    Endpoint Encryption
    risk 0.37cvss 5.7epss 0.00

    In Symantec Endpoint Encryption before SEE 11.1.3HF3, a kernel memory leak is a type of resource leak that can occur when a computer program incorrectly manages memory allocations in such a way that memory which is no longer needed is not released. In object-oriented…

  • CVE-2017-13682MedOct 23, 2017
    Symantec
    Encryption Desktop
    risk 0.37cvss 5.7epss 0.00

    In Symantec Encryption Desktop before SED 10.4.1 MP2HF1, a kernel memory leak is a type of resource leak that can occur when a computer program incorrectly manages memory allocations in such a way that memory which is no longer needed is not released. In object-oriented…

  • CVE-2017-13772HigOct 23, 2017
    TP-Link
    WR940N
    risk 0.64cvss 8.8epss 0.51

    Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arbitrary code via the (1) ping_addr parameter to PingIframeRpm.htm or (2) dnsserver2 parameter to WanStaticIpV6CfgRpm.htm.

  • CVE-2015-6839MedOct 23, 2017
    MSA
    vot.Ar
    risk 0.30cvss 4.6epss 0.00

    The parse function in MSA vot.Ar 3.1 does not check whether a candidate receives more than one vote, which allows physically proximate attackers to cast multiple votes for a candidate via a crafted RFID ballot tag.

  • CVE-2015-5533HigOct 23, 2017
    WordPress
    Count Per Day
    risk 0.43cvss 7.2epss 0.07

    SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the cpd_keep_month parameter to wp-admin/options-general.php. NOTE: this can be leveraged…

  • CVE-2015-5532MedOct 23, 2017
    WordPress
    Paid Memberships Pro
    risk 0.33cvss 6.1epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in…

  • CVE-2015-5379MedOct 23, 2017
    Gecad Technologies
    Mail Server
    risk 0.35cvss 5.4epss 0.02

    Cross-site scripting (XSS) vulnerability in actions.hsp in the Ajax WebMail interface in AXIGEN Mail Server before 9.0 allows remote attackers to inject arbitrary web script or HTML via an email attachment.

  • CVE-2015-2878HigOct 23, 2017
    Hexis
    HawkEye G
    risk 0.61cvss 8.8epss 0.04

    Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that (1) add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the (2)…

  • CVE-2014-3744HigOct 23, 2017
    Node.js
    Node.js
    risk 0.44cvss 7.5epss 0.34

    Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.

  • CVE-2014-3741CriOct 23, 2017
    Node Printer Project
    Node Printer
    risk 0.57cvss 9.8epss 0.04

    The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.

  • CVE-2013-7377HigOct 23, 2017
    Codem Transcode Project
    Codem Transcode
    risk 0.53cvss 8.1epss 0.02

    The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.

  • CVE-2012-4570CriOct 23, 2017
    Letodms Project
    Letodms
    risk 0.64cvss 9.8epss 0.02

    SQL injection vulnerability in LetoDMS_Core/Core/inc.ClassDMS.php in LetoDMS (formerly MyDMS) before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-4569MedOct 23, 2017
    Letodms Project
    Letodms
    risk 0.40cvss 6.1epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in out/out.UsrMgr.php in LetoDMS (formerly MyDMS) before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2012-4568HigOct 23, 2017
    Letodms Project
    Letodms
    risk 0.57cvss 8.8epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2012-4567MedOct 23, 2017
    Letodms Project
    Letodms
    risk 0.40cvss 6.1epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) inc/inc.ClassUI.php or (2) out/out.DocumentNotify.php.

  • CVE-2011-4334HigOct 23, 2017
    Labwiki Project
    Labwiki
    risk 0.61cvss 8.8epss 0.06

    edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrary PHP files via a PHP file with a .gif extension in the userfile parameter.

  • CVE-2011-4333MedOct 23, 2017
    Labwiki Project
    Labwiki
    risk 0.43cvss 6.1epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) from parameter to index.php or the (2) page_no parameter to recentchanges.php.

  • CVE-2011-2684MedOct 23, 2017
    Rkkda
    Foo2zjs
    risk 0.36cvss 5.5epss 0.00

    foo2zjs before 20110722dfsg-3ubuntu1 as packaged in Ubuntu, 20110722dfsg-1 as packaged in Debian unstable, and 20090908dfsg-5.1+squeeze0 as packaged in Debian squeeze create temporary files insecurely, which allows local users to write over arbitrary files via a symlink attack…