VYPR

CVEs

402,864 total · page 6308 of 8,058

AllCriticalHighKEV
  • CVE-2017-9564MedJun 16, 2017
    Community Banks Cb2go
    community-banks-cb2go
    risk 0.38cvss 5.9epss 0.00

    The community-banks-cb2go/id445828071 app 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2017-9563MedJun 16, 2017
    First Citizens Community Bank
    fccb/id809930960 app
    risk 0.38cvss 5.9epss 0.00

    The First Citizens Community Bank fccb/id809930960 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2017-9562MedJun 16, 2017
    Freedom First
    freedom-1st-credit-union-mobile-banking
    risk 0.38cvss 5.9epss 0.00

    The Freedom First freedom-1st-credit-union-mobile-banking/id1085229458 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2017-9561MedJun 16, 2017
    Lee Bank & Trust
    lbtc-mobile
    risk 0.38cvss 5.9epss 0.00

    The Lee Bank & Trust lbtc-mobile/id1068984753 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2017-9560MedJun 16, 2017
    Cayugalakenationalbank
    Cayuga Lake National Bank
    risk 0.38cvss 5.9epss 0.00

    The cayuga-lake-national-bank/id1151601539 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2017-9559MedJun 16, 2017
    Meafinancial
    Vision Bank
    risk 0.38cvss 5.9epss 0.00

    The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2017-9558MedJun 16, 2017
    Wawacu
    Wawa Employees Credit Union Mobile
    risk 0.38cvss 5.9epss 0.00

    The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2017-9097CriJun 16, 2017
    Hoytech
    Antiweb
    risk 0.59cvss 9.1epss 0.04

    In Anti-Web through 3.8.7, as used on NetBiter FGW200 devices through 3.21.2, WS100 devices through 3.30.5, EC150 devices through 1.40.0, WS200 devices through 3.30.4, EC250 devices through 1.40.0, and other products, an LFI vulnerability allows a remote attacker to read or…

  • CVE-2017-8487HigJun 15, 2017
    Microsoft
    Windows Xp
    risk 0.58cvss 7.8epss 0.54

    Windows OLE in Windows XP and Windows Server 2003 allows an attacker to execute code when a victim opens a specially crafted file or program aka "Windows olecnv32.dll Remote Code Execution Vulnerability."

  • CVE-2017-8461HigJun 15, 2017
    Microsoft
    Windows Xp
    risk 0.55cvss 7.8epss 0.20

    Windows RPC with Routing and Remote Access enabled in Windows XP and Windows Server 2003 allows an attacker to execute code on a targeted RPC server which has Routing and Remote Access enabled via a specially crafted application, aka "Windows RPC Remote Code Execution…

  • CVE-2017-7876CriJun 15, 2017
    Qnap
    Qts
    risk 0.65cvss 10.0epss 0.03

    This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. QNAP have already fixed the issue in QTS 4.2.6 build 20170517, QTS 4.3.3.0174 build 20170503 and later versions.

  • CVE-2017-7629HigJun 15, 2017
    Qnap
    Qts
    risk 0.49cvss 7.5epss 0.01

    QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function.

  • CVE-2017-9675HigJun 15, 2017
    Dlink
    Dir 605l Firmware
    risk 0.53cvss 7.5epss 0.12

    On D-Link DIR-605L devices, firmware before 2.08UIBetaB01.bin allows an unauthenticated GET request to trigger a reboot.

  • CVE-2017-9419MedJun 15, 2017
    Webhammer
    Wp Custom Fields Search
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter.

  • CVE-2017-9674MedJun 15, 2017
    Simplece
    Simplece
    risk 0.35cvss 5.4epss 0.01

    In SimpleCE 2.3.0, an authenticated XSS vulnerability was found on index.php/content/text/1?return_url=[XSS] exploitable as a regular or admin user.

  • CVE-2017-9673HigJun 15, 2017
    Simplece
    Simplece
    risk 0.57cvss 8.8epss 0.01

    In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account (via the index.php/user/new URI) or change its settings (via the index.php/user/1 URI), including its password.

  • CVE-2017-9613MedJun 15, 2017
    SAP
    Successfactors
    risk 0.35cvss 5.4epss 0.01

    Stored Cross-site scripting (XSS) vulnerability in SAP SuccessFactors before b1705.1234962 allows remote authenticated users to inject arbitrary web script or HTML via the file upload functionality.

  • CVE-2017-9505MedJun 15, 2017
    Atlassian
    Confluence
    risk 0.28cvss 4.3epss 0.01

    Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of…

  • CVE-2016-10395HigJun 15, 2017
    Revenera
    Flexnet Publisher
    risk 0.51cvss 7.8epss 0.00

    In FlexNet Publisher versions before Luton SP1 (11.14.1.1) running FlexNet Publisher Licensing Service on Windows platform, a boundary error related to a named pipe within the FlexNet Publisher Licensing Service can be exploited to cause an out-of-bounds memory read access and…

  • CVE-2017-5244LowJun 15, 2017
    Rapid7
    Metasploit
    risk 0.23cvss 3.5epss 0.01

    Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stop_all routes change the state of the service. This could have allowed an attacker to stop currently-running…

  • CVE-2015-7732HigJun 15, 2017
    Avira
    Avira Mobile Security
    risk 0.49cvss 7.5epss 0.01

    The Avira Mobile Security app before 1.5.11 for iOS sends sensitive login information in cleartext.

  • CVE-2017-9670HigJun 15, 2017
    Gnuplot
    Gnuplot
    risk 0.51cvss 7.8epss 0.01

    An uninitialized stack variable vulnerability in load_tic_series() in set.c in gnuplot 5.2.rc1 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact when a victim opens a specially crafted file.

  • CVE-2017-1379HigJun 15, 2017
    IBM
    API Connect
    risk 0.49cvss 7.5epss 0.02

    IBM API Connect 5.0.0.0 could allow a remote attacker to obtain sensitive information, caused by improper handling of requests to the Developer Portal. IBM X-Force ID: 127002.

  • CVE-2017-1197CriJun 15, 2017
    IBM
    Bigfix Compliance
    risk 0.64cvss 9.8epss 0.02

    IBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 123672.

  • CVE-2017-9606HigJun 15, 2017
    Infotecs
    Vipnet Client
    risk 0.47cvss 7.3epss 0.00

    Infotecs ViPNet Client and Coordinator before 4.3.2-42442 allow local users to gain privileges by placing a Trojan horse ViPNet update file in the update folder. The attack succeeds because of incorrect folder permissions in conjunction with a lack of integrity and authenticity…

  • CVE-2017-8555MedJun 15, 2017
    Microsoft
    Edge
    risk 0.29cvss 4.3epss 0.13

    Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to trick a user into loading a page with malicious content when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents, aka "Microsoft Edge Security Feature Bypass…

  • CVE-2017-8553MedJun 15, 2017
    Microsoft
    Windows Server 2008
    risk 0.31cvss 4.7epss 0.03

    An information disclosure vulnerability exists in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows Server 2016 when the Windows kernel improperly handles objects in memory, aka "GDI Information Disclosure…

  • CVE-2017-8552HigJun 15, 2017
    Microsoft
    Windows Server 2008
    risk 0.51cvss 7.8epss 0.01

    A kernel-mode driver in Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows 8 allows an elevation of privilege when it fails to properly handle objects in memory, aka "Win32k…

  • CVE-2017-8551MedJun 15, 2017
    Microsoft
    Project Server
    risk 0.40cvss 6.1epss 0.03

    An elevation of privilege vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint XSS vulnerability".

  • CVE-2017-8550MedJun 15, 2017
    Microsoft
    Skype For Business
    risk 0.40cvss 5.4epss 0.22

    A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Business Remote Code Execution Vulnerability".

  • CVE-2017-8549HigJun 15, 2017
    Microsoft
    Edge
    risk 0.49cvss 7.5epss 0.06

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system when Microsoft Edge improperly handles objects in memory, aka "Scripting Engine Memory Corruption…

  • CVE-2017-8548HigJun 15, 2017
    Microsoft
    Edge
    risk 0.57cvss 7.5epss 0.68

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system when Microsoft Edge improperly handles objects in memory, aka "Scripting Engine Memory Corruption…

  • CVE-2017-8547HigJun 15, 2017
    Microsoft
    Internet Explorer
    risk 0.49cvss 7.5epss 0.06

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to execute arbitrary code in the context of the current user when Internet Explorer improperly accesses objects in memory,…

  • CVE-2017-8545MedJun 15, 2017
    Microsoft
    Outlook
    risk 0.43cvss 6.5epss 0.05

    A spoofing vulnerability exists in when Microsoft Outlook for Mac does not sanitize html properly, aka "Microsoft Outlook for Mac Spoofing Vulnerability".

  • CVE-2017-8544MedJun 15, 2017
    Microsoft
    Windows Server 2008
    risk 0.36cvss 5.5epss 0.03

    Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to obtain information to further compromise the user's system when Windows…

  • CVE-2017-8543CriKEVJun 15, 2017
    Microsoft
    Windows Server 2008
    risk 0.82cvss 9.8epss 0.74

    Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an…

  • CVE-2017-8534MedJun 15, 2017
    Microsoft
    Office
    risk 0.43cvss 6.5epss 0.06

    Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows improper disclosure of memory contents,…

  • CVE-2017-8533MedJun 15, 2017
    Microsoft
    Windows Server 2008
    risk 0.43cvss 6.5epss 0.08

    Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Graphics Uniscribe Information Disclosure…

  • CVE-2017-8532MedJun 15, 2017
    Microsoft
    Windows Server 2008
    risk 0.43cvss 6.5epss 0.07

    Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Graphics Uniscribe Information Disclosure…

  • CVE-2017-8531MedJun 15, 2017
    Microsoft
    Office
    risk 0.43cvss 6.5epss 0.07

    Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016, Microsoft Office 2007 Service Pack 3, and Microsoft Office 2010 Service Pack 2 allows improper…

  • CVE-2017-8530MedJun 15, 2017
    Microsoft
    Edge
    risk 0.35cvss 5.4epss 0.02

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with malicious content when Microsoft Edge does not properly enforce same-origin policies, aka "Microsoft Edge Security Feature…

  • CVE-2017-8529MedJun 15, 2017
    Microsoft
    Internet Explorer
    risk 0.43cvss 6.5epss 0.14

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's computer when affected Microsoft scripting engines do not properly handle objects in…

  • CVE-2017-8528HigJun 15, 2017
    Microsoft
    Office
    risk 0.59cvss 8.8epss 0.20

    Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows a remote code execution vulnerability…

  • CVE-2017-8527HigJun 15, 2017
    Microsoft
    Windows Server 2008
    risk 0.59cvss 8.8epss 0.19

    Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to the way it handles objects in memory, aka…

  • CVE-2017-8524HigJun 15, 2017
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.10

    Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an allow an attacker to execute arbitrary code in the context of the…

  • CVE-2017-8523MedJun 15, 2017
    Microsoft
    Edge
    risk 0.28cvss 4.3epss 0.01

    Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to trick a user into loading a page with malicious content when Microsoft Edge fails to correctly apply Same Origin Policy for HTML elements present in other browser…

  • CVE-2017-8522HigJun 15, 2017
    Microsoft
    Internet Explorer
    risk 0.49cvss 7.5epss 0.08

    Microsoft browsers in Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engines fail to…

  • CVE-2017-8521HigJun 15, 2017
    Microsoft
    Edge
    risk 0.49cvss 7.5epss 0.06

    Microsoft Edge in Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the Edge JavaScript scripting engine fails to handle objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from…

  • CVE-2017-8520HigJun 15, 2017
    Microsoft
    Edge
    risk 0.49cvss 7.5epss 0.09

    Microsoft Edge in Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the Edge JavaScript scripting engine fails to handle objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from…

  • CVE-2017-8519HigJun 15, 2017
    Microsoft
    Internet Explorer
    risk 0.49cvss 7.5epss 0.06

    Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to execute arbitrary code in the context of the current user when Internet Explorer improperly accesses objects in…