VYPR

CVEs

401,490 total · page 6386 of 8,030

AllCriticalHighKEV
  • CVE-2016-8236HigMar 3, 2017
    Lenovo
    ThinkServer TSM
    risk 0.49cvss 7.5epss 0.01

    Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM versions earlier than 3.77.

  • CVE-2016-3127HigMar 3, 2017
    Blackberry
    Good Control Server
    risk 0.49cvss 7.5epss 0.01

    An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allows remote attackers to gain and use logged encryption keys to access certain resources within a customer's Good deployment by gaining…

  • CVE-2016-10070MedMar 3, 2017
    ImageMagick
    Imagemagick
    risk 0.29cvss 5.5epss 0.02

    Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.

  • CVE-2016-10066MedMar 3, 2017
    ImageMagick
    Imagemagick
    risk 0.29cvss 5.5epss 0.02

    Buffer overflow in the ReadVIFFImage function in coders/viff.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a crafted file.

  • CVE-2016-10065HigMar 3, 2017
    ImageMagick
    Imagemagick
    risk 0.44cvss 7.8epss 0.02

    The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.

  • CVE-2016-10061MedMar 3, 2017
    ImageMagick
    Imagemagick
    risk 0.35cvss 6.5epss 0.03

    The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (crash) via a crafted image file.

  • CVE-2016-7972HigMar 3, 2017
    Libass Project
    Libass
    risk 0.49cvss 7.5epss 0.05

    The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.

  • CVE-2016-7970HigMar 3, 2017
    Libass Project
    Libass
    risk 0.49cvss 7.5epss 0.05

    Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of service via unspecified vectors.

  • CVE-2016-7969HigMar 3, 2017
    Libass Project
    Libass
    risk 0.49cvss 7.5epss 0.05

    The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization."

  • CVE-2016-7409MedMar 3, 2017
    Dropbear SSH Project
    Dropbear SSH
    risk 0.36cvss 5.5epss 0.00

    The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v argument, related to a failed remote ident.

  • CVE-2016-7408HigMar 3, 2017
    Dropbear SSH Project
    Dropbear SSH
    risk 0.58cvss 8.8epss 0.04

    The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.

  • CVE-2016-7407CriMar 3, 2017
    Dropbear SSH Project
    Dropbear SSH
    risk 0.64cvss 9.8epss 0.06

    The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file.

  • CVE-2016-7406CriMar 3, 2017
    Dropbear SSH Project
    Dropbear SSH
    risk 0.65cvss 9.8epss 0.10

    Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.

  • CVE-2016-6884MedMar 3, 2017
    Matrixssl
    Matrixssl
    risk 0.42cvss 6.5epss 0.01

    TLS cipher suites with CBC mode in TLS 1.1 and 1.2 in MatrixSSL before 3.8.3 allow remote attackers to cause a denial of service (out-of-bounds read) via a crafted message.

  • CVE-2016-6883MedMar 3, 2017
    Matrixssl
    Matrixssl
    risk 0.42cvss 5.9epss 0.14

    MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a Bleichenbacher variant attack.

  • CVE-2016-6882MedMar 3, 2017
    Matrixssl
    Matrixssl
    risk 0.38cvss 5.9epss 0.01

    MatrixSSL before 3.8.7, when the DHE_RSA based cipher suite is supported, makes it easier for remote attackers to obtain RSA private key information by conducting a Lenstra side-channel attack.

  • CVE-2015-8815MedMar 3, 2017
    Umbraco
    Umbraco CMS
    risk 0.40cvss 6.1epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Umbraco before 7.4.0 allow remote attackers to inject arbitrary web script or HTML via the name parameter to (1) the media page, (2) the developer data edit page, or (3) the form page.

  • CVE-2015-8814HigMar 3, 2017
    Umbraco
    Umbraco CMS
    risk 0.50cvss 8.8epss 0.01

    Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the templates.asmx.cs file.

  • CVE-2015-8813HigMar 3, 2017
    Umbraco
    Umbraco CMS
    risk 0.47cvss 8.2epss 0.11

    The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.

  • CVE-2017-5867MedMar 3, 2017
    OwnCloud
    Owncloud
    risk 0.42cvss 6.5epss 0.01

    ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to cause a denial of service (server hang and logfile flooding) via a one bit BMP file.

  • CVE-2017-5866MedMar 3, 2017
    OwnCloud
    Owncloud
    risk 0.28cvss 4.3epss 0.01

    The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors.

  • CVE-2017-5865LowMar 3, 2017
    OwnCloud
    Owncloud
    risk 0.24cvss 3.7epss 0.01

    The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number…

  • CVE-2017-5836HigMar 3, 2017
    Libplist
    libplist
    risk 0.49cvss 7.5epss 0.03

    The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.

  • CVE-2017-5835HigMar 3, 2017
    Libplist
    libplist
    risk 0.49cvss 7.5epss 0.03

    libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.

  • CVE-2017-5834MedMar 3, 2017
    Libplist
    libplist
    risk 0.36cvss 5.5epss 0.01

    The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file.

  • CVE-2017-5833MedMar 3, 2017
    Revive Adserver
    Adserver
    risk 0.40cvss 6.1epss 0.02

    Cross-site scripting (XSS) vulnerability in the invocation code generation for interstitial zones in Revive Adserver before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

  • CVE-2017-5832MedMar 3, 2017
    Revive Adserver
    Adserver
    risk 0.35cvss 5.4epss 0.01

    Cross-site scripting (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user's email address.

  • CVE-2017-5831MedMar 3, 2017
    Revive Adserver
    Adserver
    risk 0.38cvss 5.9epss 0.01

    Session fixation vulnerability in the forgot password mechanism in Revive Adserver before 4.0.1, when setting a new password, allows remote attackers to hijack web sessions via the session ID.

  • CVE-2017-5830CriMar 3, 2017
    Revive Adserver
    Adserver
    risk 0.64cvss 9.8epss 0.03

    Revive Adserver before 4.0.1 allows remote attackers to execute arbitrary code via serialized data in the cookies related to the delivery scripts.

  • CVE-2017-5616MedMar 3, 2017
    CPanel
    Cgiecho
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in cgiemail and cgiecho allows remote attackers to inject arbitrary web script or HTML via the addendum parameter.

  • CVE-2017-5615MedMar 3, 2017
    CPanel
    Cgiecho
    risk 0.40cvss 6.1epss 0.01

    cgiemail and cgiecho allow remote attackers to inject HTTP headers via a newline character in the redirect location.

  • CVE-2017-5614MedMar 3, 2017
    CPanel
    Cgiecho
    risk 0.40cvss 6.1epss 0.01

    Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1) success or (2) failure parameter.

  • CVE-2017-5613HigMar 3, 2017
    CPanel
    Cgiecho
    risk 0.51cvss 7.8epss 0.03

    Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file.

  • CVE-2017-5571MedMar 3, 2017
    Revenera
    Flexnet Publisher
    risk 0.40cvss 6.1epss 0.02

    Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 and earlier, as used in Citrix License Server for Windows and the Citrix License Server VPX, allows remote attackers to redirect users to arbitrary web sites and…

  • CVE-2017-5356HigMar 3, 2017
    Irssi
    Irssi
    risk 0.49cvss 7.5epss 0.05

    Irssi before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a string containing a formatting sequence (%[) without a closing bracket (]).

  • CVE-2017-5196HigMar 3, 2017
    Irssi
    Irssi
    risk 0.49cvss 7.5epss 0.05

    Irssi 0.8.18 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via vectors involving strings that are not UTF8.

  • CVE-2017-5195HigMar 3, 2017
    Irssi
    Irssi
    risk 0.49cvss 7.5epss 0.05

    Irssi 0.8.17 before 0.8.21 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ANSI x8 color code.

  • CVE-2017-5194HigMar 3, 2017
    Irssi
    Irssi
    risk 0.49cvss 7.5epss 0.05

    Use-after-free vulnerability in Irssi before 0.8.21 allows remote attackers to cause a denial of service (crash) via an invalid nick message.

  • CVE-2017-5193HigMar 3, 2017
    Irssi
    Irssi
    risk 0.49cvss 7.5epss 0.06

    The nickcmp function in Irssi before 0.8.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a message without a nick.

  • CVE-2017-2290HigMar 3, 2017
    Puppet (software)
    Puppet Enterprise
    risk 0.57cvss 8.8epss 0.01

    On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolved in…

  • CVE-2016-10206HigMar 3, 2017
    Zoneminder
    Zoneminder
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack the authentication of users for requests that change passwords and possibly have unspecified other impact as demonstrated by a crafted user action request to…

  • CVE-2016-10205HigMar 3, 2017
    Zoneminder
    Zoneminder
    risk 0.48cvss 7.3epss 0.01

    Session fixation vulnerability in Zoneminder 1.30 and earlier allows remote attackers to hijack web sessions via the ZMSESSID cookie.

  • CVE-2016-10204CriMar 3, 2017
    Zoneminder
    Zoneminder
    risk 0.64cvss 9.8epss 0.02

    SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via the limit parameter in a log query request to index.php.

  • CVE-2016-10203MedMar 3, 2017
    Zoneminder
    Zoneminder
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the name when creating a new monitor.

  • CVE-2016-10202MedMar 3, 2017
    Zoneminder
    Zoneminder
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php.

  • CVE-2016-10201MedMar 3, 2017
    Zoneminder
    Zoneminder
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the format parameter in a download log request to index.php.

  • CVE-2016-10194CriMar 3, 2017
    Festivaltts4r Project
    Festivaltts4r
    risk 0.64cvss 9.8epss 0.03

    The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speech or (2) to_mp3 method in lib/festivaltts4r/festival4r.rb.

  • CVE-2016-10193CriMar 3, 2017
    Espeak Ruby Project
    Espeak Ruby
    risk 0.57cvss 9.8epss 0.02

    The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.

  • CVE-2016-10127CriMar 3, 2017
    Pysaml2 Project
    Pysaml2
    risk 0.52cvss 9.0epss 0.03

    PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.

  • CVE-2015-2877LowMar 3, 2017
    Linux
    Kernel
    risk 0.22cvss 3.3epss 0.01

    Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack. NOTE: the…