VYPR

CVEs

401,567 total · page 6360 of 8,032

AllCriticalHighKEV
  • CVE-2017-5684LowApr 3, 2017
    Intel
    Compute Stick
    risk 0.25cvss 3.9epss 0.00

    The BIOS in Intel Compute Stick systems based on 6th Gen Intel Core processors prior to version CC047 may allow an attacker with physical access to the system to gain access to personal information.

  • CVE-2017-7407LowApr 3, 2017
    Curl
    Curl
    risk 0.09cvss 2.4epss 0.01

    The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%'…

  • CVE-2017-7397HigApr 3, 2017
    Backbox
    Backbox Linux
    risk 0.53cvss 7.5epss 0.11

    BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packets with Martian source IP addresses (as defined in RFC 1812 section 5.3.7). This product enables net.ipv4.conf.all.log_martians by default. NOTE: the vendor…

  • CVE-2016-10317HigApr 3, 2017
    Artifex
    Ghostscript
    risk 0.51cvss 7.8epss 0.02

    The fill_threshhold_buffer function in base/gxht_thresh.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript…

  • CVE-2017-7402CriApr 3, 2017
    Lucidcrew
    Pixie
    risk 0.67cvss 9.8epss 0.05

    Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.

  • CVE-2017-5642CriApr 3, 2017
    Apache
    Ambari
    risk 0.64cvss 9.8epss 0.02

    During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs.

  • CVE-2014-3930HigApr 3, 2017
    Cistron-LG
    Cistron-LG
    risk 0.49cvss 7.5epss 0.02

    lg.pl in Cistron-LG 1.01 stores sensitive information under the web root with insufficient access controls, which allows remote attackers to obtain IP addresses and other unspecified router credentials.

  • CVE-2014-3929HigApr 3, 2017
    Cougar
    lg
    risk 0.49cvss 7.5epss 0.02

    The default configuration for Cougar-LG stores sensitive information under the web root with insufficient access control, which might allow remote attackers to obtain private ssh keys.

  • CVE-2014-3928CriApr 3, 2017
    Cougar
    lg
    risk 0.64cvss 9.8epss 0.02

    Cougar-LG stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain credentials.

  • CVE-2014-3927CriApr 3, 2017
    Mrlg4php Project
    Mrlg4php
    risk 0.64cvss 9.8epss 0.04

    mrlg-lib.php in mrlg4php before 1.0.8 allows remote attackers to execute arbitrary shell code.

  • CVE-2014-1677HigApr 3, 2017
    Technicolor
    Tc7200
    risk 0.53cvss 7.5epss 0.18

    Technicolor TC7200 with firmware STD6.01.12 could allow remote attackers to obtain sensitive information.

  • CVE-2013-7450HigApr 3, 2017
    Pulpproject
    Pulp
    risk 0.42cvss 7.5epss 0.01

    Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.

  • CVE-2017-7401HigApr 3, 2017
    Collectd
    Collectd
    risk 0.49cvss 7.5epss 0.04

    Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with "SecurityLevel None" and with empty…

  • CVE-2017-7400MedApr 3, 2017
    OpenStack
    Horizon
    risk 0.31cvss 4.8epss 0.01

    OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.

  • CVE-2017-7383MedApr 3, 2017
    Podofo Project
    Podofo
    risk 0.36cvss 5.5epss 0.01

    The PdfFontFactory.cpp:195:62 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.

  • CVE-2017-7382MedApr 3, 2017
    Podofo Project
    Podofo
    risk 0.36cvss 5.5epss 0.01

    The PdfFontFactory.cpp:200:88 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.

  • CVE-2017-7381MedApr 3, 2017
    Podofo Project
    Podofo
    risk 0.36cvss 5.5epss 0.01

    The doc/PdfPage.cpp:609:23 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.

  • CVE-2017-7380MedApr 3, 2017
    Podofo Project
    Podofo
    risk 0.36cvss 5.5epss 0.01

    The doc/PdfPage.cpp:614:20 code in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.

  • CVE-2017-7379MedApr 3, 2017
    Podofo Project
    Podofo
    risk 0.36cvss 5.5epss 0.01

    The PoDoFo::PdfSimpleEncoding::ConvertToEncoding function in PdfEncoding.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.

  • CVE-2017-7378MedApr 3, 2017
    Podofo Project
    Podofo
    risk 0.36cvss 5.5epss 0.01

    The PoDoFo::PdfPainter::ExpandTabs function in PdfPainter.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PDF document.

  • CVE-2017-6448HigApr 3, 2017
    Radare
    Radare2
    risk 0.51cvss 7.8epss 0.02

    The dalvik_disassemble function in libr/asm/p/asm_dalvik.c in radare2 1.2.1 allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted DEX file.

  • CVE-2017-6441HigApr 3, 2017
    PHP
    PHP
    risk 0.49cvss 7.5epss 0.02

    The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of "declare(ticks=" in a PHP script. NOTE: the vendor disputes the classification of this as a…

  • CVE-2017-6194HigApr 3, 2017
    Radare
    Radare2
    risk 0.51cvss 7.8epss 0.02

    The relocs function in libr/bin/p/bin_bflt.c in radare2 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

  • CVE-2017-6181HigApr 3, 2017
    Onigmo
    Onigmo
    risk 0.49cvss 7.5epss 0.04

    The parse_char_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression library, as used in Ruby 2.4.0, allows remote attackers to cause a denial of service (deep recursion and application crash) via a crafted regular expression.

  • CVE-2017-5951MedApr 3, 2017
    Artifex
    Ghostscript
    risk 0.36cvss 5.5epss 0.02

    The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.

  • CVE-2017-5950MedApr 3, 2017
    YAML Cpp Project
    YAML Cpp
    risk 0.36cvss 5.5epss 0.02

    The SingleDocParser::HandleNode function in yaml-cpp (aka LibYaml-C++) 0.5.3 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file.

  • CVE-2017-5949CriApr 3, 2017
    Apple Inc.
    Safari
    risk 0.64cvss 9.8epss 0.02

    JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service (heap-based out-of-bounds write and application crash) or possibly have unspecified other impact via crafted JavaScript code that triggers…

  • CVE-2017-5924HigApr 3, 2017
    Virustotal
    Yara
    risk 0.49cvss 7.5epss 0.02

    libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_compiler_destroy function.

  • CVE-2017-5923HigApr 3, 2017
    Virustotal
    Yara
    risk 0.49cvss 7.5epss 0.02

    libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function.

  • CVE-2016-10316MedApr 3, 2017
    Jensen of Scandinavia
    Air:Link 3G
    risk 0.40cvss 6.1epss 0.01

    Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to conduct Open Redirect attacks via the return-url parameter to /goform/formLogout.

  • CVE-2016-10315MedApr 3, 2017
    Jensen of Scandinavia
    Air:Link 3G
    risk 0.40cvss 6.1epss 0.01

    Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to conduct Open Redirect attacks via the submit-url parameter to certain /goform/* pages.

  • CVE-2016-10314HigApr 3, 2017
    Jensen of Scandinavia
    Air:Link 3G
    risk 0.57cvss 8.8epss 0.01

    Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to read passwords via a direct request to the x.asp page.

  • CVE-2016-10313HigApr 3, 2017
    Jensen of Scandinavia
    Air:Link 3G
    risk 0.57cvss 8.8epss 0.01

    Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to conduct CSRF attacks via certain /goform/* pages.

  • CVE-2016-10312CriApr 3, 2017
    Jensen of Scandinavia
    Air:Link 3G
    risk 0.64cvss 9.8epss 0.03

    Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to execute arbitrary commands via shell metacharacters to certain /goform/* pages.

  • CVE-2016-10226HigApr 3, 2017
    Apple Inc.
    Safari
    risk 0.49cvss 7.5epss 0.02

    JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service (bitfield out-of-bounds read and application crash) via crafted JavaScript code that is mishandled in the operatorString function, related to…

  • CVE-2016-10222HigApr 3, 2017
    Apple Inc.
    Safari
    risk 0.49cvss 7.5epss 0.02

    runtime/JSONObject.cpp in JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 18, allows remote attackers to cause a denial of service (segmentation violation and application crash) via crafted JavaScript code that triggers a "type confusion" in the…

  • CVE-2016-10221MedApr 3, 2017
    Artifex
    Mupdf
    risk 0.28cvss 4.3epss 0.01

    The count_entries function in pdf-layer.c in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted PDF document.

  • CVE-2016-10220MedApr 3, 2017
    Artifex
    Ghostscript
    risk 0.36cvss 5.5epss 0.02

    The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module.

  • CVE-2016-10219MedApr 3, 2017
    Artifex
    Ghostscript
    risk 0.36cvss 5.5epss 0.02

    The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.

  • CVE-2016-10218MedApr 3, 2017
    Artifex
    Ghostscript
    risk 0.36cvss 5.5epss 0.01

    The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF Transparency module in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.

  • CVE-2016-10217MedApr 3, 2017
    Artifex
    Ghostscript
    risk 0.36cvss 5.5epss 0.01

    The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is mishandled in the color management module.

  • CVE-2016-10211HigApr 3, 2017
    Virustotal
    Yara
    risk 0.42cvss 7.5epss 0.02

    libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule that is mishandled in the yr_parser_lookup_loop_variable function.

  • CVE-2016-10210HigApr 3, 2017
    Virustotal
    Yara
    risk 0.42cvss 7.5epss 0.03

    libyara/lexer.l in YARA 3.5.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted rule that is mishandled in the yy_get_next_buffer function.

  • CVE-2016-10209MedApr 3, 2017
    Libarchive
    Libarchive
    risk 0.36cvss 5.5epss 0.02

    The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file.

  • CVE-2017-1001000HigApr 3, 2017
    WordPress
    WordPress
    risk 0.52cvss 7.5epss 0.85

    The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts…

  • CVE-2016-8803HigApr 2, 2017
    Huawei
    Fusionstorage
    risk 0.49cvss 7.5epss 0.00

    The maintenance module in Huawei FusionStorage V100R003C30U1 allows attackers to create documents according to special rules to obtain the OS root privilege of FusionStorage.

  • CVE-2016-8802MedApr 2, 2017
    Huawei
    Secospace Usg6300 Firmware
    risk 0.42cvss 6.5epss 0.01

    The security policy processing module in Huawei Secospace USG6300 with software V500R001C20SPC100, V500R001C20SPC101, V500R001C20SPC200; Secospace USG6500 with software V500R001C20SPC100, V500R001C20SPC101, V500R001C20SPC200; Secospace USG6600 with software V500R001C20SPC100,…

  • CVE-2016-8801HigApr 2, 2017
    Huawei
    OceanStor 5600 V3
    risk 0.47cvss 7.2epss 0.01

    Huawei OceanStor 5600 V3 with V300R003C00C10 and earlier versions allows attackers with administrator privilege to inject a command into a specific command's parameters, and run this injected command with root privilege.

  • CVE-2016-8798HigApr 2, 2017
    Huawei
    USG5500
    risk 0.49cvss 7.5epss 0.01

    Huawei USG5500 with software V300R001C00 and V300R001C00 allows attackers to bypass the anti-DDoS module of the USGs to cause a denial of service condition on the backend server.

  • CVE-2016-8797HigApr 2, 2017
    Huawei
    S5300
    risk 0.49cvss 7.5epss 0.01

    Huawei AR3200 with software V200R007C00, V200R005C32, V200R005C20; S12700 with software V200R008C00, V200R007C00; S5300 with software V200R008C00, V200R007C00, V200R006C00; S5700 with software V200R008C00, V200R007C00, V200R006C00; S6300 with software V200R008C00, V200R007C00;…