| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-5058 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2017 | OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay. | ||
| CVE-2016-5057 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2017 | OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning. | ||
| CVE-2016-5056 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2017 | OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK. | ||
| CVE-2016-5055 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page. | ||
| CVE-2016-5054 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2017 | OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay. | ||
| CVE-2016-5053 | Cri | 0.64 | 9.8 | 0.03 | Apr 10, 2017 | OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000. | ||
| CVE-2016-5052 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2017 | OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning. | ||
| CVE-2016-5051 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2017 | OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application. | ||
| CVE-2016-4334 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | Jive before 2016.3.1 has an open redirect from the external-link.jspa page. | ||
| CVE-2016-4320 | Med | 0.28 | 4.3 | 0.02 | Apr 10, 2017 | Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource. | ||
| CVE-2016-4319 | Hig | 0.57 | 8.8 | 0.01 | Apr 10, 2017 | Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings. | ||
| CVE-2016-4318 | Med | 0.31 | 4.8 | 0.01 | Apr 10, 2017 | Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name. | ||
| CVE-2016-4317 | Med | 0.35 | 5.4 | 0.01 | Apr 10, 2017 | Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page. | ||
| CVE-2016-1517 | Med | 0.29 | 5.5 | 0.01 | Apr 10, 2017 | OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks. | ||
| CVE-2016-1516 | Hig | 0.50 | 8.8 | 0.02 | Apr 10, 2017 | OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code. | ||
| CVE-2015-8276 | Med | 0.36 | 5.5 | 0.01 | Apr 10, 2017 | LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to read arbitrary files via crafted EDOC files. | ||
| CVE-2015-8275 | Med | 0.36 | 5.5 | 0.01 | Apr 10, 2017 | LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files. | ||
| CVE-2015-8258 | Hig | 0.52 | 7.5 | 0.09 | Apr 10, 2017 | AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a "resource injection vulnerability." | ||
| CVE-2015-8255 | Hig | 0.60 | 8.8 | 0.02 | Apr 10, 2017 | AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi. | ||
| CVE-2015-7292 | Cri | 0.64 | 9.8 | 0.02 | Apr 10, 2017 | Stack-based buffer overflow in the havok_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-01-15 allows attackers to cause a denial of service (panic) or possibly have unspecified other impact via a long string to /dev/hv. | ||
| CVE-2015-7275 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS. | ||
| CVE-2015-7274 | Hig | 0.57 | 8.8 | 0.02 | Apr 10, 2017 | Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 allows remote attackers to execute arbitrary administrative HTTP commands. | ||
| CVE-2015-7273 | Cri | 0.64 | 9.8 | 0.01 | Apr 10, 2017 | Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE. | ||
| CVE-2015-7272 | Cri | 0.64 | 9.8 | 0.03 | Apr 10, 2017 | Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long SSH username or input. | ||
| CVE-2015-7271 | Cri | 0.64 | 9.8 | 0.03 | Apr 10, 2017 | Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue in racadm getsystinfo. | ||
| CVE-2015-7270 | Hig | 0.51 | 7.8 | 0.01 | Apr 10, 2017 | Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal. | ||
| CVE-2015-7265 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2017 | Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks. | ||
| CVE-2015-7264 | Cri | 0.64 | 9.8 | 0.01 | Apr 10, 2017 | The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks. | ||
| CVE-2015-7263 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2017 | The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value. | ||
| CVE-2015-7260 | Hig | 0.51 | 7.8 | 0.00 | Apr 10, 2017 | Liebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing the LiebertM executable file. | ||
| CVE-2015-6035 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | Opsview before 2015-11-06 has XSS via SNMP. | ||
| CVE-2015-6028 | Hig | 0.57 | 8.8 | 0.01 | Apr 10, 2017 | Castle Rock Computing SNMPc before 2015-12-17 has SQL injection via the sc parameter. | ||
| CVE-2015-6027 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | Castle Rock Computing SNMPc before 2015-12-17 has XSS via SNMP. | ||
| CVE-2015-6021 | Med | 0.40 | 6.1 | 0.01 | Apr 10, 2017 | Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response. | ||
| CVE-2015-2889 | Hig | 0.57 | 8.8 | 0.02 | Apr 10, 2017 | Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to gain privileges via manual entry of a Settings URL. | ||
| CVE-2015-2888 | Cri | 0.64 | 9.8 | 0.02 | Apr 10, 2017 | Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to bypass authentication, related to the MySnapCam web service. | ||
| CVE-2015-2887 | Cri | 0.64 | 9.8 | 0.01 | Apr 10, 2017 | iBaby M3S has a password of admin for the backdoor admin account. | ||
| CVE-2015-2886 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2017 | iBaby M6 allows remote attackers to obtain sensitive information, related to the ibabycloud.com service. | ||
| CVE-2015-2885 | Cri | 0.64 | 9.8 | 0.01 | Apr 10, 2017 | Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password of guest for the backdoor guest account. | ||
| CVE-2015-2884 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2017 | Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u8 URIs, and cam_service_enable.cgi. | ||
| CVE-2015-2883 | Med | 0.35 | 5.4 | 0.01 | Apr 10, 2017 | Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or shareDevice.php. | ||
| CVE-2015-2882 | Cri | 0.64 | 9.8 | 0.02 | Apr 10, 2017 | Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg3500 account, a password of M100-4674448 for the backdoor user account, and a password of M100-4674448… | ||
| CVE-2015-2881 | Cri | 0.64 | 9.8 | 0.02 | Apr 10, 2017 | Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account. | ||
| CVE-2015-2880 | Hig | 0.57 | 8.8 | 0.01 | Apr 10, 2017 | TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account. | ||
| CVE-2014-2960 | Hig | 0.49 | 7.5 | 0.01 | Apr 10, 2017 | Vision Critical before 2014-05-30 allows attackers to read arbitrary files via unspecified vectors, as demonstrated by image files and configuration files. | ||
| CVE-2017-7614 | Cri | 0.64 | 9.8 | 0.04 | Apr 9, 2017 | elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have… | ||
| CVE-2017-7613 | Med | 0.36 | 5.5 | 0.02 | Apr 9, 2017 | elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file. | ||
| CVE-2017-7612 | Med | 0.36 | 5.5 | 0.02 | Apr 9, 2017 | The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. | ||
| CVE-2017-7611 | Med | 0.36 | 5.5 | 0.02 | Apr 9, 2017 | The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. | ||
| CVE-2017-7610 | Med | 0.36 | 5.5 | 0.02 | Apr 9, 2017 | The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. |
- risk 0.49cvss 7.5epss 0.01
OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay.
- risk 0.49cvss 7.5epss 0.01
OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning.
- risk 0.49cvss 7.5epss 0.01
OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK.
- risk 0.40cvss 6.1epss 0.01
OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page.
- risk 0.49cvss 7.5epss 0.01
OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay.
- risk 0.64cvss 9.8epss 0.03
OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000.
- risk 0.49cvss 7.5epss 0.01
OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning.
- risk 0.49cvss 7.5epss 0.01
OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.
- risk 0.40cvss 6.1epss 0.01
Jive before 2016.3.1 has an open redirect from the external-link.jspa page.
- risk 0.28cvss 4.3epss 0.02
Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource.
- risk 0.57cvss 8.8epss 0.01
Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings.
- risk 0.31cvss 4.8epss 0.01
Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name.
- risk 0.35cvss 5.4epss 0.01
Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page.
- risk 0.29cvss 5.5epss 0.01
OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks.
- risk 0.50cvss 8.8epss 0.02
OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code.
- risk 0.36cvss 5.5epss 0.01
LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to read arbitrary files via crafted EDOC files.
- risk 0.36cvss 5.5epss 0.01
LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files.
- risk 0.52cvss 7.5epss 0.09
AXIS Communications products with firmware through 5.80.x allow remote attackers to modify arbitrary files as root via vectors involving Open Script Editor, aka a "resource injection vulnerability."
- risk 0.60cvss 8.8epss 0.02
AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi.
- risk 0.64cvss 9.8epss 0.02
Stack-based buffer overflow in the havok_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-01-15 allows attackers to cause a denial of service (panic) or possibly have unspecified other impact via a long string to /dev/hv.
- risk 0.40cvss 6.1epss 0.01
Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS.
- risk 0.57cvss 8.8epss 0.02
Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 allows remote attackers to execute arbitrary administrative HTTP commands.
- risk 0.64cvss 9.8epss 0.01
Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.
- risk 0.64cvss 9.8epss 0.03
Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long SSH username or input.
- risk 0.64cvss 9.8epss 0.03
Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue in racadm getsystinfo.
- risk 0.51cvss 7.8epss 0.01
Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows directory traversal.
- risk 0.49cvss 7.5epss 0.01
Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks.
- risk 0.64cvss 9.8epss 0.01
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
- risk 0.49cvss 7.5epss 0.01
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value.
- risk 0.51cvss 7.8epss 0.00
Liebert MultiLink Automated Shutdown v4.2.4 allows local users to gain privileges by replacing the LiebertM executable file.
- risk 0.40cvss 6.1epss 0.01
Opsview before 2015-11-06 has XSS via SNMP.
- risk 0.57cvss 8.8epss 0.01
Castle Rock Computing SNMPc before 2015-12-17 has SQL injection via the sc parameter.
- risk 0.40cvss 6.1epss 0.01
Castle Rock Computing SNMPc before 2015-12-17 has XSS via SNMP.
- risk 0.40cvss 6.1epss 0.01
Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response.
- risk 0.57cvss 8.8epss 0.02
Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to gain privileges via manual entry of a Settings URL.
- risk 0.64cvss 9.8epss 0.02
Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to bypass authentication, related to the MySnapCam web service.
- risk 0.64cvss 9.8epss 0.01
iBaby M3S has a password of admin for the backdoor admin account.
- risk 0.49cvss 7.5epss 0.01
iBaby M6 allows remote attackers to obtain sensitive information, related to the ibabycloud.com service.
- risk 0.64cvss 9.8epss 0.01
Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password of guest for the backdoor guest account.
- risk 0.49cvss 7.5epss 0.01
Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u8 URIs, and cam_service_enable.cgi.
- risk 0.35cvss 5.4epss 0.01
Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or shareDevice.php.
- risk 0.64cvss 9.8epss 0.02
Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg3500 account, a password of M100-4674448 for the backdoor user account, and a password of M100-4674448…
- risk 0.64cvss 9.8epss 0.02
Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account.
- risk 0.57cvss 8.8epss 0.01
TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account.
- risk 0.49cvss 7.5epss 0.01
Vision Critical before 2014-05-30 allows attackers to read arbitrary files via unspecified vectors, as demonstrated by image files and configuration files.
- risk 0.64cvss 9.8epss 0.04
elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have…
- risk 0.36cvss 5.5epss 0.02
elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.
- risk 0.36cvss 5.5epss 0.02
The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
- risk 0.36cvss 5.5epss 0.02
The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.
- risk 0.36cvss 5.5epss 0.02
The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.