VYPR

CVEs

37,303 total · page 628 of 747

AllCriticalHighKEV
  • CVE-2018-16489CriFeb 1, 2019
    Just Extend Project
    Just Extend
    risk 0.64cvss 9.8epss 0.02

    A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.

  • CVE-2018-16486CriFeb 1, 2019
    Defaults Deep Project
    Defaults Deep
    risk 0.64cvss 9.8epss 0.01

    A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.

  • CVE-2019-7297CriJan 31, 2019
    Dlink
    Dir 823x Firmware
    risk 0.65cvss 9.8epss 0.08

    An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function…

  • CVE-2018-5560CriJan 31, 2019
    Practecol
    Guardzilla All-In-One Video Security System
    risk 0.65cvss 10.0epss 0.02

    A reliance on a static, hard-coded credential in the design of the cloud-based storage system of Practecol's Guardzilla All-In-One Video Security System allows an attacker to view the private data of all users of the Guardzilla device.

  • CVE-2018-12548CriJan 31, 2019
    Eclipse
    Openj9
    risk 0.64cvss 9.8epss 0.01

    In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public static natives which accept pointer values that are dereferenced in the native code.

  • CVE-2018-18941CriJan 31, 2019
    Vignette
    Content Management
    risk 0.64cvss 9.8epss 0.02

    In Vignette Content Management version 6, it is possible to gain remote access to administrator privileges by discovering the admin password in the vgn/ccb/user/mgmt/user/edit/0,1628,0,00.html?uid=admin HTML source code, and then creating a privileged user account. NOTE: this…

  • CVE-2019-7249CriJan 31, 2019
    Keybase
    Keybase
    risk 0.64cvss 9.8epss 0.02

    In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system (who didn't have root access) to tamper with another's installs.

  • CVE-2019-6438CriJan 31, 2019
    Schedmd
    Slurm
    risk 0.64cvss 9.8epss 0.02

    SchedMD Slurm before 17.11.13 and 18.x before 18.08.5 mishandles 32-bit systems.

  • CVE-2019-7234CriJan 30, 2019
    Idreamsoft
    Icms
    risk 0.59cvss 9.1epss 0.02

    An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../ to begin the process of creating a ZIP archive file with the complete contents of any directory because of an apps.admincp.php error. This ZIP archive file…

  • CVE-2018-20750CriJan 30, 2019
    Libvncserver
    Libvncserver
    risk 0.00cvss 9.8epss 0.03

    LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.

  • CVE-2018-20749CriJan 30, 2019
    Libvncserver
    Libvncserver
    risk 0.00cvss 9.8epss 0.03

    LibVNC before 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c. The fix for CVE-2018-15127 was incomplete.

  • CVE-2018-20748CriJan 30, 2019
    Libvncserver
    libvncclient
    risk 0.00cvss 9.8epss 0.03

    LibVNC before 0.9.12 contains multiple heap out-of-bounds write vulnerabilities in libvncclient/rfbproto.c. The fix for CVE-2018-20019 was incomplete.

  • CVE-2018-17431CriJan 30, 2019
    Comodo
    UTM Firewall
    risk 0.73cvss 9.8epss 0.84

    Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL.

  • CVE-2019-7160CriJan 29, 2019
    Idreamsoft
    Icms
    risk 0.64cvss 9.8epss 0.03

    idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php.

  • CVE-2018-10612CriJan 29, 2019
    3S Smart Software Solutions
    CODESYS
    risk 0.64cvss 9.8epss 0.01

    In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.

  • CVE-2019-6991CriJan 28, 2019
    Zoneminder
    Zoneminder
    risk 0.00cvss 9.8epss 0.03

    A classic Stack-based buffer overflow exists in the zmLoadUser() function in zm_user.cpp of the zmu binary in ZoneMinder through 1.32.3, allowing an unauthenticated attacker to execute code via a long username.

  • CVE-2019-6978CriJan 28, 2019
    Libgd
    Libgd
    risk 0.57cvss 9.8epss 0.04

    The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.

  • CVE-2019-6703CriJan 27, 2019
    Calmar Webmedia
    Total Donations
    risk 0.66cvss 9.8epss 0.10

    Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to…

  • CVE-2019-6798CriJan 26, 2019
    PhpMyAdmin
    phpMyAdmin
    risk 0.64cvss 9.8epss 0.03

    An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature.

  • CVE-2019-6805CriJan 25, 2019
    S CMS
    S CMS
    risk 0.64cvss 9.8epss 0.01

    SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php O_id parameter.

  • CVE-2019-1651CriJan 24, 2019
    Cisco Systems, Inc.
    Vsmart Controller
    risk 0.65cvss 9.9epss 0.05

    A vulnerability in the vContainer of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and execute arbitrary code as the root user. The vulnerability is due to improper bounds checking by the vContainer. An…

  • CVE-2019-6713CriJan 23, 2019
    Thinkcmf
    Thinkcmf
    risk 0.64cvss 9.8epss 0.02

    app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a file_put_contents call.

  • CVE-2017-17836CriJan 23, 2019
    Apache
    Airflow
    risk 0.64cvss 9.8epss 0.03

    In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all…

  • CVE-2019-6260CriJan 22, 2019
    Aspeed
    aspeed_acry
    risk 0.64cvss 9.8epss 0.03

    The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) bridges, which allow arbitrary read and write access to the BMC's physical address space from the host (or from the network in unusual cases…

  • CVE-2018-6444CriJan 22, 2019
    Brocade
    Network Advisor
    risk 0.64cvss 9.8epss 0.03

    A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. The vulnerability could also be exploited to execute arbitrary OS Commands.

  • CVE-2019-6339CriJan 22, 2019
    Drupal
    Drupal
    risk 0.59cvss 9.8epss 0.27

    In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom)…

  • CVE-2018-19635CriJan 22, 2019
    Ca
    Service Desk Manager
    risk 0.64cvss 9.8epss 0.01

    CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to escalate privileges in the user interface.

  • CVE-2019-6503CriJan 22, 2019
    Chatopera
    Cosin
    risk 0.64cvss 9.8epss 0.02

    There is a deserialization vulnerability in Chatopera cosin v3.10.0. An attacker can execute commands during server-side deserialization by uploading maliciously constructed files. This is related to the TemplateController.java impsave method and the MainUtils toObject method.

  • CVE-2019-6497CriJan 20, 2019
    Hotels Server Project
    Hotels Server
    risk 0.64cvss 9.8epss 0.01

    Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter.

  • CVE-2019-3774CriJan 18, 2019
    Cloudfoundry
    Spring Batch
    risk 0.64cvss 9.8epss 0.03

    Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

  • CVE-2019-3773CriJan 18, 2019
    Cloudfoundry
    Spring Web Services
    risk 0.64cvss 9.8epss 0.04

    Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

  • CVE-2019-3772CriJan 18, 2019
    VMware
    Spring Integration
    risk 0.57cvss 9.8epss 0.03

    Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

  • CVE-2018-5915CriJan 18, 2019
    Qualcomm
    Snapdragon Mobile
    risk 0.64cvss 9.8epss 0.01

    Exception in Modem IP stack while processing IPv6 packet in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 /…

  • CVE-2018-11284CriJan 18, 2019
    Qualcomm
    Snapdragon
    risk 0.60cvss 9.3epss 0.01

    Spoofed SMS can be used to send a large number of messages to the device which will in turn initiate a flood of registration updates with the server in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 625, SD 636, SDA660,…

  • CVE-2017-18160CriJan 18, 2019
    Qualcomm
    Snapdragon
    risk 0.64cvss 9.8epss 0.01

    AGPS session failure in GNSS module due to cyphersuites are hardcoded and needed manual update everytime in snapdragon mobile and snapdragon wear in versions MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 835, SD 845, SD 850

  • CVE-2019-3910CriJan 18, 2019
    Crestron
    AM-100
    risk 0.60cvss 9.1epss 0.08

    Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device.

  • CVE-2019-3909CriJan 18, 2019
    Identicard
    Premisys ID
    risk 0.64cvss 9.8epss 0.02

    Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention.

  • CVE-2018-19716CriJan 18, 2019
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.09

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a heap overflow…

  • CVE-2018-19715CriJan 18, 2019
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.05

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free…

  • CVE-2018-19708CriJan 18, 2019
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.05

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free…

  • CVE-2018-19707CriJan 18, 2019
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.05

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free…

  • CVE-2018-19702CriJan 18, 2019
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.05

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an out-of-bounds write…

  • CVE-2018-19700CriJan 18, 2019
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.05

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free…

  • CVE-2018-19698CriJan 18, 2019
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.05

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free…

  • CVE-2018-16040CriJan 18, 2019
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.05

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free…

  • CVE-2018-16039CriJan 18, 2019
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.05

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free…

  • CVE-2018-16037CriJan 18, 2019
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.05

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free…

  • CVE-2018-16036CriJan 18, 2019
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.05

    Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a use after free…

  • CVE-2018-20732CriJan 17, 2019
    Sas
    Web Infrastructure Platform
    risk 0.64cvss 9.8epss 0.04

    SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant.

  • CVE-2019-2489CriJan 16, 2019
    Oracle Corporation
    E Business Suite
    risk 0.59cvss 9.1epss 0.02

    Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: OCM Query). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker…