VYPR

CVEs

402,926 total · page 6299 of 8,059

AllCriticalHighKEV
  • CVE-2017-10743HigJul 5, 2017
    Xnview
    Xnview
    risk 0.51cvss 7.8epss 0.00

    XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "Stack Buffer Overrun (/GS Exception) starting at ntdll_77df0000!LdrpInitializeNode+0x000000000000015b."

  • CVE-2017-10742HigJul 5, 2017
    Xnview
    Xnview
    risk 0.51cvss 7.8epss 0.00

    XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "Data Execution Prevention Violation starting at Unknown Symbol @ 0x00000000380a0500 called from…

  • CVE-2017-10741HigJul 5, 2017
    Xnview
    Xnview
    risk 0.51cvss 7.8epss 0.00

    XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at ntdll_77df0000!RtlpWaitOnCriticalSection+0x0000000000000121."

  • CVE-2017-10740HigJul 5, 2017
    Xnview
    Xnview
    risk 0.51cvss 7.8epss 0.00

    XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at ntdll_77df0000!RtlRbInsertNodeEx+0x000000000000002d."

  • CVE-2017-10739HigJul 5, 2017
    Xnview
    Xnview
    risk 0.51cvss 7.8epss 0.00

    XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "Data Execution Prevention Violation starting at Unknown Symbol @ 0x000000000c1b541c called from xnview+0x00000000003826ec."

  • CVE-2017-10738HigJul 5, 2017
    Xnview
    Xnview
    risk 0.51cvss 7.8epss 0.00

    XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "Data Execution Prevention Violation starting at Unknown Symbol @ 0x000000002f32332f called from…

  • CVE-2017-10737HigJul 5, 2017
    Xnview
    Xnview
    risk 0.51cvss 7.8epss 0.00

    XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at ntdll_77df0000!RtlpCoalesceFreeBlocks+0x00000000000002e6."

  • CVE-2017-10736HigJul 5, 2017
    Xnview
    Xnview
    risk 0.51cvss 7.8epss 0.00

    XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at msvcrt!_VEC_memzero+0x000000000000006a."

  • CVE-2017-10735HigJul 5, 2017
    IrfanView
    Irfanview
    risk 0.51cvss 7.8epss 0.02

    IrfanView version 4.44 (32bit) might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .rle file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!RtlpFreeHeap+0x00000000000003ca."

  • CVE-2017-10734HigJul 5, 2017
    IrfanView
    Irfanview
    risk 0.51cvss 7.8epss 0.02

    IrfanView version 4.44 (32bit) might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .rle file, related to an "Invalid Handle starting at wow64!Wow64NotifyDebugger+0x000000000000001d."

  • CVE-2017-10733HigJul 5, 2017
    IrfanView
    Irfanview
    risk 0.51cvss 7.8epss 0.02

    IrfanView version 4.44 (32bit) might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .rle file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!RtlpEnterCriticalSectionContended+0x000…

  • CVE-2017-10732HigJul 5, 2017
    IrfanView
    Irfanview
    risk 0.51cvss 7.8epss 0.02

    IrfanView version 4.44 (32bit) might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .rle file, related to "Data from Faulting Address controls Branch Selection starting at ntdll_77df0000!RtlpAllocateHeap+0x0000000000000429."

  • CVE-2017-10731HigJul 5, 2017
    IrfanView
    Irfanview
    risk 0.51cvss 7.8epss 0.02

    IrfanView version 4.44 (32bit) allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at FORMATS!GetPlugInInfo+0x0000000000007d80."

  • CVE-2017-10730HigJul 5, 2017
    IrfanView
    Irfanview
    risk 0.51cvss 7.8epss 0.02

    IrfanView version 4.44 (32bit) allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at FORMATS!GetPlugInInfo+0x0000000000007d96."

  • CVE-2017-10729HigJul 5, 2017
    IrfanView
    Irfanview
    risk 0.51cvss 7.8epss 0.02

    IrfanView version 4.44 (32bit) allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "User Mode Write AV starting at ntdll_77df0000!RtlpWaitOnCriticalSection+0x0000000000000121."

  • CVE-2017-10728HigJul 5, 2017
    Winamp
    Winamp
    risk 0.51cvss 7.8epss 0.01

    Winamp 5.666 Build 3516(x86) might allow attackers to execute arbitrary code or cause a denial of service via a crafted .flv file, related to "Error Code (0xe06d7363) starting at wow64!Wow64NotifyDebugger+0x000000000000001d."

  • CVE-2017-10727HigJul 5, 2017
    Winamp
    Winamp
    risk 0.51cvss 7.8epss 0.01

    Winamp 5.666 Build 3516(x86) might allow attackers to execute arbitrary code or cause a denial of service via a crafted .flv file, related to "Data from Faulting Address controls Branch Selection starting at in_mp3!DeleteAudioDecoder+0x000000000000762f."

  • CVE-2017-10726HigJul 5, 2017
    Winamp
    Winamp
    risk 0.51cvss 7.8epss 0.01

    Winamp 5.666 Build 3516(x86) might allow attackers to execute arbitrary code or cause a denial of service via a crafted .flv file, related to "Data from Faulting Address may be used as a return value starting at f263!GetWinamp5SystemComponent+0x0000000000001951."

  • CVE-2017-10725HigJul 5, 2017
    Winamp
    Winamp
    risk 0.47cvss 7.3epss 0.00

    Winamp 5.666 Build 3516(x86) allows attackers to execute arbitrary code or cause a denial of service via a crafted .flv file, related to "Data from Faulting Address controls Code Flow starting at in_flv!winampGetInModule2+0x00000000000009a8."

  • CVE-2017-1264HigJul 5, 2017
    IBM
    Security Guardium
    risk 0.49cvss 7.5epss 0.02

    IBM Security Guardium 10.0 does not prove or insufficiently proves that the actors identity is correct which can lead to exposure of resources or functionality to unintended actors. IBM X-Force ID: 124739.

  • CVE-2017-1254HigJul 5, 2017
    IBM
    Security Guardium
    risk 0.46cvss 7.1epss 0.02

    IBM Security Guardium 10.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 124634.

  • CVE-2017-1253CriJul 5, 2017
    IBM
    Security Guardium
    risk 0.65cvss 9.9epss 0.02

    IBM Security Guardium 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 124633.

  • CVE-2017-1157MedJul 5, 2017
    IBM
    Jazz Reporting Service
    risk 0.28cvss 4.3epss 0.01

    IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could allow an authenticated attacker to access report data that should be restricted to authorized users. IBM X-Force ID: 122788.

  • CVE-2017-1144LowJul 5, 2017
    IBM
    Websphere Message Broker
    risk 0.16cvss 2.5epss 0.00

    IBM WebSphere Message Broker could allow a local user with specialized access to prevent the message broker from starting. IBM X-Force ID: 122033.

  • CVE-2017-1096MedJul 5, 2017
    IBM
    Jazz Reporting Service
    risk 0.35cvss 5.4epss 0.01

    IBM Jazz Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.…

  • CVE-2016-9989MedJul 5, 2017
    IBM
    JRS
    risk 0.35cvss 5.4epss 0.01

    IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…

  • CVE-2016-9988MedJul 5, 2017
    IBM
    JRS
    risk 0.35cvss 5.4epss 0.01

    IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…

  • CVE-2016-9987MedJul 5, 2017
    IBM
    JRS
    risk 0.35cvss 5.4epss 0.01

    IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…

  • CVE-2016-9986MedJul 5, 2017
    IBM
    JRS
    risk 0.35cvss 5.4epss 0.01

    IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…

  • CVE-2016-9700MedJul 5, 2017
    IBM
    Jazz Foundation
    risk 0.28cvss 4.3epss 0.01

    IBM Jazz Foundation could allow an authenticated attacker to obtain sensitive information from error message stack traces. IBM X-Force ID: 119528.

  • CVE-2017-1208MedJul 5, 2017
    IBM
    Maximo Asset Management
    risk 0.35cvss 5.4epss 0.01

    IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.…

  • CVE-2017-1207MedJul 5, 2017
    IBM
    Websphere Message Broker
    risk 0.36cvss 5.5epss 0.00

    IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123777.

  • CVE-2017-1176LowJul 5, 2017
    IBM
    Maximo Asset Management
    risk 0.21cvss 3.3epss 0.00

    IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local user to obtain sensitive information due to inappropriate data retention of attachments. IBM X-Force ID: 123299.

  • CVE-2017-1175CriJul 5, 2017
    IBM
    Maximo Asset Management
    risk 0.64cvss 9.8epss 0.02

    IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 123297.

  • CVE-2017-1113MedJul 5, 2017
    IBM
    Rational Team Concert
    risk 0.35cvss 5.4epss 0.01

    IBM Rational Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted…

  • CVE-2016-9746MedJul 5, 2017
    IBM
    Rational Team Concert
    risk 0.35cvss 5.4epss 0.01

    IBM Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…

  • CVE-2016-9733MedJul 5, 2017
    IBM
    RTC
    risk 0.35cvss 5.4epss 0.01

    IBM Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…

  • CVE-2016-9701MedJul 5, 2017
    IBM
    Rational Team Concert
    risk 0.35cvss 5.4epss 0.01

    IBM Team Concert 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…

  • CVE-2017-2295HigJul 5, 2017
    Puppet (software)
    Puppet
    risk 0.53cvss 8.2epss 0.02

    Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change…

  • CVE-2017-2294HigJul 5, 2017
    Puppet (software)
    Puppet Enterprise
    risk 0.49cvss 7.5epss 0.01

    Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen…

  • CVE-2017-1269CriJul 5, 2017
    IBM
    Security Guardium
    risk 0.64cvss 9.8epss 0.02

    IBM Security Guardium 10.0 and 10.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-force ID: 124744

  • CVE-2017-1258MedJul 5, 2017
    IBM
    Security Guardium
    risk 0.42cvss 6.5epss 0.01

    IBM Security Guardium 10.0 and 10.1 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 124685

  • CVE-2017-1256MedJul 5, 2017
    IBM
    Security Guardium
    risk 0.40cvss 6.1epss 0.01

    IBM Security Guardium 10.0, 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…

  • CVE-2017-1217MedJul 5, 2017
    IBM
    Websphere Portal
    risk 0.40cvss 6.1epss 0.01

    IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…

  • CVE-2016-0238LowJul 5, 2017
    IBM
    Security Guardium
    risk 0.24cvss 3.7epss 0.01

    IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 110409

  • CVE-2017-10929HigJul 5, 2017
    Radare
    Radare2
    risk 0.51cvss 7.8epss 0.02

    The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, possibly related to a read overflow in…

  • CVE-2017-10928HigJul 5, 2017
    ImageMagick
    Imagemagick
    risk 0.57cvss 8.8epss 0.04

    In ImageMagick 7.0.6-0, a heap-based buffer over-read in the GetNextToken function in token.c allows remote attackers to obtain sensitive information from process memory or possibly have unspecified other impact via a crafted SVG document that is mishandled in the…

  • CVE-2017-10923MedJul 5, 2017
    Xen
    Xen
    risk 0.42cvss 6.5epss 0.02

    Xen through 4.8.x does not validate a vCPU array index upon the sending of an SGI, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-225.

  • CVE-2017-10922HigJul 5, 2017
    Xen
    Xen
    risk 0.49cvss 7.5epss 0.02

    The grant-table feature in Xen through 4.8.x mishandles MMIO region grant references, which allows guest OS users to cause a denial of service (loss of grant trackability), aka XSA-224 bug 3.

  • CVE-2017-10921CriJul 5, 2017
    Xen
    Xen
    risk 0.65cvss 10.0epss 0.03

    The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and GNTMAP_host_map mapping, which allows guest OS users to cause a denial of service (count mismanagement and memory corruption) or obtain privileged host OS access, aka…