VYPR

CVEs

403,921 total · page 6234 of 8,079

AllCriticalHighKEV
  • CVE-2017-5701HigOct 11, 2017
    Intel
    NUC7i3BNK
    risk 0.46cvss 7.1epss 0.00

    Insecure platform configuration in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows an attacker with physical presence to run arbitrary code via unauthorized firmware modification during BIOS Recovery.

  • CVE-2017-5700HigOct 11, 2017
    Intel
    NUC7i3BNK
    risk 0.55cvss 8.4epss 0.00

    Insufficient protection of password storage in system firmware for Intel NUC7i3BNK, NUC7i3BNH, NUC7i5BNK, NUC7i5BNH, NUC7i7BNH versions BN0049 and below allows local attackers to bypass Administrator and User passwords via access to password storage.

  • CVE-2017-15226CriOct 10, 2017
    Zyxel
    NBG6716
    risk 0.64cvss 9.8epss 0.02

    Zyxel NBG6716 V1.00(AAKG.9)C0 devices allow command injection in the ozkerz component because beginIndex and endIndex are used directly in a popen call.

  • CVE-2017-15225MedOct 10, 2017
    GNU
    Binutils
    risk 0.36cvss 5.5epss 0.01

    _bfd_dwarf2_cleanup_debug_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory leak) via a crafted ELF file.

  • CVE-2017-8994CriOct 10, 2017
    Microfocus
    Operations Orchestration
    risk 0.64cvss 9.8epss 0.10

    A input validation vulnerability in HPE Operations Orchestration product all versions prior to 10.80, allows for the execution of code remotely.

  • CVE-2017-1538MedOct 10, 2017
    IBM
    Financial Transaction Manager
    risk 0.42cvss 6.5epss 0.01

    IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive information from an undocumented URL. IBM X-Force ID: 130735.

  • CVE-2017-15219MedOct 10, 2017
    Dotcms
    Dotcms
    risk 0.35cvss 5.4epss 0.01

    The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting (XSS) affecting a vanity-urls Title field, a containers Description field, and a templates Description field.

  • CVE-2017-15193HigOct 10, 2017
    Wireshark
    Wireshark
    risk 0.49cvss 7.5epss 0.03

    In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissectors/packet-mbim.c by changing the memory-allocation approach.

  • CVE-2017-15192HigOct 10, 2017
    Wireshark
    Wireshark
    risk 0.49cvss 7.5epss 0.02

    In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by considering a case where not all of the BTATT packets have the same encapsulation level.

  • CVE-2017-15191HigOct 10, 2017
    Wireshark
    Wireshark
    risk 0.49cvss 7.5epss 0.03

    In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packet-dmp.c by validating a string length.

  • CVE-2017-15190HigOct 10, 2017
    Wireshark
    Wireshark
    risk 0.49cvss 7.5epss 0.02

    In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of a variable.

  • CVE-2017-15189HigOct 10, 2017
    Wireshark
    Wireshark
    risk 0.49cvss 7.5epss 0.02

    In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by adding decrements.

  • CVE-2017-1503MedOct 10, 2017
    IBM
    Websphere Application Server
    risk 0.40cvss 6.1epss 0.02

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the…

  • CVE-2017-9717HigOct 10, 2017
    Google
    Android
    risk 0.49cvss 7.5epss 0.01

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while parsing Netlink attributes, a buffer overread can occur.

  • CVE-2017-9715HigOct 10, 2017
    Google
    Android
    risk 0.49cvss 7.5epss 0.01

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a vendor command, a buffer over-read can occur.

  • CVE-2017-9714HigOct 10, 2017
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an out of bound memory access may happen in limCheckRxRSNIeMatch in case incorrect RSNIE is received from the client in assoc request.

  • CVE-2017-9706HigOct 10, 2017
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an array out-of-bounds access can potentially occur in a display driver.

  • CVE-2017-9697HigOct 10, 2017
    Google
    Android
    risk 0.46cvss 7.0epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition can allow access to already freed memory while reading command registration table entries in diag_dbgfs_read_table.

  • CVE-2017-9687HigOct 10, 2017
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, two concurrent threads/processes can write the value of "0" to the debugfs file that controls ipa ipc log which will lead to the double-free in…

  • CVE-2017-9686HigOct 10, 2017
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possible double free/use after free in the SPS driver when debugfs logging is used.

  • CVE-2017-9683HigOct 10, 2017
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a meta image, an integer overflow can occur, if user-defined image offset and size values are too large.

  • CVE-2017-15218MedOct 10, 2017
    ImageMagick
    Imagemagick
    risk 0.42cvss 6.5epss 0.02

    ImageMagick 7.0.7-2 has a memory leak in ReadOneJNGImage in coders/png.c.

  • CVE-2017-15217MedOct 10, 2017
    ImageMagick
    Imagemagick
    risk 0.42cvss 6.5epss 0.02

    ImageMagick 7.0.7-2 has a memory leak in ReadSGIImage in coders/sgi.c.

  • CVE-2017-11067HigOct 10, 2017
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the Athdiag procfs entry does not have a proper address sanity check which may potentially lead to the use of an out-of-range pointer offset.

  • CVE-2017-11064HigOct 10, 2017
    Google
    Android
    risk 0.49cvss 7.5epss 0.01

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed during processing of ACA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_PASSPOINT_LIST and QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_LIST cfg80211…

  • CVE-2017-11063MedOct 10, 2017
    Google
    Android
    risk 0.38cvss 5.9epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, as a result of a race condition between two userspace processes that interact with the driver concurrently, a null pointer dereference can potentially occur.

  • CVE-2017-11062HigOct 10, 2017
    Google
    Android
    risk 0.49cvss 7.5epss 0.01

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, currently attributes are not validated in __wlan_hdd_cfg80211_do_acs which can potentially lead to a buffer overread.

  • CVE-2017-11061HigOct 10, 2017
    Google
    Android
    risk 0.49cvss 7.5epss 0.01

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing cfg80211 vendor sub command QCA_NL80211_VENDOR_SUBCMD_ROAM, a buffer over-read can occur.

  • CVE-2017-11060HigOct 10, 2017
    Google
    Android
    risk 0.49cvss 7.5epss 0.01

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed during processing of ACA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_PASSPOINT_LIST and QCA_NL80211_VENDOR_SUBCMD_EXTSCAN_PNO_SET_LIST cfg80211…

  • CVE-2017-11059HigOct 10, 2017
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, setting the HMAC key by different threads during SHA operations may potentially lead to a buffer overflow.

  • CVE-2017-11057HigOct 10, 2017
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in compatibility mode, flash_data from 64-bit userspace may cause disclosure of kernel memory or a fault due to using a userspace-provided address.

  • CVE-2017-11056HigOct 10, 2017
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while doing sha and cipher operations, a userspace buffer is directly accessed in kernel space potentially leading to a page fault.

  • CVE-2017-11055HigOct 10, 2017
    Linux
    Kernel
    risk 0.49cvss 7.5epss 0.01

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION cfg80211 vendor command, a buffer over-read can occur.

  • CVE-2017-11054HigOct 10, 2017
    Google
    Android
    risk 0.49cvss 7.5epss 0.01

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted cfg80211 vendor command, a buffer over-read can occur.

  • CVE-2017-11053HigOct 10, 2017
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when qos map set IE of length less than 16 is received in association response or in qos map configure action frame, a buffer overflow can potentially occur in…

  • CVE-2017-11052HigOct 10, 2017
    Linux
    Kernel
    risk 0.49cvss 7.5epss 0.01

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted QCA_NL80211_VENDOR_SUBCMD_NDP cfg80211 vendor command a buffer over-read can occur.

  • CVE-2017-11051HigOct 10, 2017
    Google
    Android
    risk 0.49cvss 7.5epss 0.01

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, information disclosure is possible in function __wlan_hdd_cfg80211_testmode since buffer hb_params is not initialized to zero.

  • CVE-2017-11050HigOct 10, 2017
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when the pktlogconf tool gives a pktlog buffer of size less than the minimal possible source data size in the host driver, a buffer overflow can potentially occur.

  • CVE-2017-11048HigOct 10, 2017
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a display driver function, a Use After Free condition can occur.

  • CVE-2017-11046HigOct 10, 2017
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when an audio driver ioctl handler is called, a kernel out-of-bounds write can potentially occur.

  • CVE-2016-10514MedOct 10, 2017
    Piwigo
    Piwigo
    risk 0.35cvss 6.5epss 0.01

    url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a " character, or a URL beginning with a substring other than the http:// or https:// substring.

  • CVE-2016-10513MedOct 10, 2017
    Piwigo
    Piwigo
    risk 0.33cvss 6.1epss 0.01

    Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php.

  • CVE-2017-13679MedOct 10, 2017
    Symantec
    Encryption Desktop
    risk 0.27cvss 4.2epss 0.00

    A denial of service (DoS) attack in Symantec Encryption Desktop before SED 10.4.1 MP2HF1 allows remote attackers to make a particular machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a specific host within a…

  • CVE-2017-13675MedOct 10, 2017
    Symantec
    Endpoint Encryption
    risk 0.27cvss 4.2epss 0.00

    A denial of service (DoS) attack in Symantec Endpoint Encryption before SEE 11.1.3HF2 allows remote attackers to make a particular machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a specific host within a network.

  • CVE-2017-15216MedOct 10, 2017
    Misp
    Misp
    risk 0.40cvss 6.1epss 0.01

    MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js.

  • CVE-2017-12623MedOct 10, 2017
    Apache
    Nifi
    risk 0.42cvss 6.5epss 0.02

    An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should…

  • CVE-2015-8239HigOct 10, 2017
    Sudo Project
    Sudo
    risk 0.46cvss 7.0epss 0.01

    The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.

  • CVE-2015-7778MedOct 10, 2017
    Gurunavi
    Gurunavi App
    risk 0.38cvss 5.9epss 0.01

    Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks.

  • CVE-2015-7503HigOct 10, 2017
    Zend
    Framework
    risk 0.49cvss 7.5epss 0.01

    Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.

  • CVE-2015-7384HigOct 10, 2017
    Node.js
    Node.js
    risk 0.42cvss 7.5epss 0.08

    Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service.