VYPR

CVEs

399,772 total · page 6399 of 7,996

AllCriticalHighKEV
  • CVE-2016-7502HigDec 23, 2016
    FFmpeg
    Ffmpeg
    risk 0.51cvss 7.8epss 0.01

    The cavs_idct8_add_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding with cavs_decode.

  • CVE-2016-7450HigDec 23, 2016
    FFmpeg
    Ffmpeg
    risk 0.51cvss 7.8epss 0.01

    The ff_log2_16bit_c function in libavutil/intmath.h in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when it decodes a malformed AIFF file.

  • CVE-2016-7122MedDec 23, 2016
    FFmpeg
    Ffmpeg
    risk 0.36cvss 5.5epss 0.01

    The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop when it decodes an AVI file that has a crafted 'nctg' structure.

  • CVE-2016-6881MedDec 23, 2016
    FFmpeg
    Ffmpeg
    risk 0.36cvss 5.5epss 0.01

    The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause an infinite loop denial of service via a crafted SWF file.

  • CVE-2016-6671HigDec 23, 2016
    FFmpeg
    Ffmpeg
    risk 0.51cvss 7.8epss 0.02

    The raw_decode function in libavcodec/rawdec.c in FFmpeg before 3.1.2 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted SWF file.

  • CVE-2016-6659HigDec 23, 2016
    Cloudfoundry
    Uaa
    risk 0.53cvss 8.1epss 0.01

    Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently…

  • CVE-2016-7954CriDec 22, 2016
    Bundler
    Bundler
    risk 0.64cvss 9.8epss 0.09

    Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.

  • CVE-2016-9675HigDec 22, 2016
    Uclouvain
    Openjpeg
    risk 0.51cvss 7.8epss 0.02

    openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045. A crafted j2k image could cause the application to crash, or potentially execute arbitrary code.

  • CVE-2016-9181HigDec 22, 2016
    Image Info
    Image-Info
    risk 0.46cvss 7.1epss 0.01

    perl-Image-Info: When parsing an SVG file, external entity expansion (XXE) was not disabled. An attacker could craft an SVG file which, when processed by an application using perl-Image-Info, could cause denial of service or, potentially, information disclosure.

  • CVE-2016-9180CriDec 22, 2016
    Perl Foundation
    XML::Twig
    risk 0.59cvss 9.1epss 0.04

    perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.

  • CVE-2016-9179HigDec 22, 2016
    Lynx
    Lynx
    risk 0.49cvss 7.5epss 0.02

    lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.

  • CVE-2016-7091MedDec 22, 2016
    Sudo Project
    Sudo
    risk 0.29cvss 4.4epss 0.00

    sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline…

  • CVE-2016-7172HigDec 21, 2016
    NetApp
    Snap Creator Framework
    risk 0.49cvss 7.5epss 0.02

    NetApp Snap Creator Framework before 4.3.1 discloses sensitive information which could be viewed by an unauthorized user.

  • CVE-2016-5851HigDec 21, 2016
    Python Openxml Project
    Python Docx
    risk 0.50cvss 8.8epss 0.02

    python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document.

  • CVE-2016-2349HigDec 21, 2016
    BMC Software
    Remedy AR System Server
    risk 0.49cvss 7.5epss 0.01

    Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password.

  • CVE-2016-9757MedDec 20, 2016
    Rapid7
    Nexpose
    risk 0.35cvss 5.4epss 0.01

    In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elements in the tag name field. Once this tag is viewed in the Tag Detail page of the Rapid7 Nexpose…

  • CVE-2016-5303MedDec 20, 2016
    Horde (software)
    Groupware
    risk 0.40cvss 6.1epss 0.02

    Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink…

  • CVE-2016-4552MedDec 20, 2016
    Roundcube
    Webmail
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message.

  • CVE-2016-7300HigDec 20, 2016
    Microsoft
    Auto Updater For Mac
    risk 0.51cvss 7.8epss 0.02

    Untrusted search path vulnerability in Microsoft Auto Updater for Mac allows local users to gain privileges via a Trojan horse executable file, aka "Microsoft (MAU) Office Elevation of Privilege Vulnerability."

  • CVE-2016-7298HigDec 20, 2016
    Microsoft
    Office
    risk 0.53cvss 7.8epss 0.23

    Microsoft Office 2007 SP3, Office 2010 SP2, Word Viewer, Office for Mac 2011, and Office 2016 for Mac allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-7297HigDec 20, 2016
    Microsoft
    Edge
    risk 0.51cvss 7.5epss 0.27

    The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7286, CVE-2016-7288,…

  • CVE-2016-7296HigDec 20, 2016
    Microsoft
    Edge
    risk 0.50cvss 7.5epss 0.17

    The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7286, CVE-2016-7288,…

  • CVE-2016-7295MedDec 20, 2016
    Microsoft
    Windows
    risk 0.36cvss 5.5epss 0.03

    The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to obtain…

  • CVE-2016-7292HigDec 20, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.01

    The Installer in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 mishandles library loading, which allows local users to gain…

  • CVE-2016-7291HigDec 20, 2016
    Microsoft
    Word
    risk 0.48cvss 7.1epss 0.23

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a…

  • CVE-2016-7290HigDec 20, 2016
    Microsoft
    Word
    risk 0.48cvss 7.1epss 0.23

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a…

  • CVE-2016-7289HigDec 20, 2016
    Microsoft
    Publisher
    risk 0.53cvss 7.8epss 0.25

    Microsoft Publisher 2010 SP2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-7288HigDec 20, 2016
    Microsoft
    Edge
    risk 0.57cvss 7.5epss 0.70

    The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7286, CVE-2016-7296,…

  • CVE-2016-7287HigDec 20, 2016
    Microsoft
    Internet Explorer
    risk 0.57cvss 7.5epss 0.69

    The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."

  • CVE-2016-7286HigDec 20, 2016
    Microsoft
    Edge
    risk 0.57cvss 7.5epss 0.69

    The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7288, CVE-2016-7296,…

  • CVE-2016-7284MedDec 20, 2016
    Microsoft
    Internet Explorer
    risk 0.29cvss 4.3epss 0.15

    Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

  • CVE-2016-7283HigDec 20, 2016
    Microsoft
    Internet Explorer
    risk 0.59cvss 8.8epss 0.18

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2016-7282MedDec 20, 2016
    Microsoft
    Internet Explorer
    risk 0.40cvss 6.1epss 0.10

    Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."

  • CVE-2016-7281MedDec 20, 2016
    Microsoft
    Internet Explorer
    risk 0.36cvss 5.3epss 0.14

    The Web Workers implementation in Microsoft Internet Explorer 10 and 11 and Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Browser Security Feature Bypass Vulnerability."

  • CVE-2016-7280MedDec 20, 2016
    Microsoft
    Edge
    risk 0.40cvss 6.1epss 0.09

    Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7206.

  • CVE-2016-7279HigDec 20, 2016
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.15

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."

  • CVE-2016-7278MedDec 20, 2016
    Microsoft
    Internet Explorer
    risk 0.36cvss 5.3epss 0.15

    Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Windows Hyperlink Object Library Information Disclosure Vulnerability."

  • CVE-2016-7277CriDec 20, 2016
    Microsoft
    Office
    risk 0.64cvss 9.6epss 0.18

    Microsoft Office 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-7276HigDec 20, 2016
    Microsoft
    Office
    risk 0.48cvss 7.1epss 0.25

    Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office for Mac 2011, and Office 2016 for Mac allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document, aka "Microsoft Office…

  • CVE-2016-7275HigDec 20, 2016
    Microsoft
    Office
    risk 0.51cvss 7.8epss 0.01

    Microsoft Office 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 mishandles library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."

  • CVE-2016-7274HigDec 20, 2016
    Microsoft
    Windows
    risk 0.64cvss 8.8epss 0.42

    Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web…

  • CVE-2016-7273HigDec 20, 2016
    Microsoft
    Windows Server 2016
    risk 0.59cvss 8.8epss 0.19

    The Graphics component in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Remote Code Execution Vulnerability."

  • CVE-2016-7272HigDec 20, 2016
    Microsoft
    Windows
    risk 0.60cvss 8.8epss 0.39

    The Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via…

  • CVE-2016-7271HigDec 20, 2016
    Microsoft
    Windows Server 2016
    risk 0.51cvss 7.8epss 0.01

    The Secure Kernel Mode implementation in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allows local users to bypass the virtual trust level (VTL) protection mechanism via a crafted application, aka "Secure Kernel Mode Elevation of Privilege Vulnerability."

  • CVE-2016-7270HigDec 20, 2016
    Microsoft
    .net Framework
    risk 0.50cvss 7.5epss 0.20

    The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, which allows remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information by leveraging key guessability, aka ".NET…

  • CVE-2016-7268HigDec 20, 2016
    Microsoft
    Word
    risk 0.48cvss 7.1epss 0.23

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory…

  • CVE-2016-7267MedDec 20, 2016
    Microsoft
    Excel
    risk 0.37cvss 5.5epss 0.19

    Microsoft Excel 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 misparses file formats, which makes it easier for remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Security Feature Bypass Vulnerability."

  • CVE-2016-7266HigDec 20, 2016
    Microsoft
    Excel
    risk 0.52cvss 7.8epss 0.22

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, and Excel 2016 for Mac mishandle a registry check, which allows user-assisted remote attackers to execute arbitrary commands via crafted embedded…

  • CVE-2016-7265HigDec 20, 2016
    Microsoft
    Excel
    risk 0.48cvss 7.1epss 0.21

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePoint Server 2007 SP3, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to obtain sensitive…

  • CVE-2016-7264HigDec 20, 2016
    Microsoft
    Excel
    risk 0.48cvss 7.1epss 0.23

    Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, Excel Viewer, Excel for Mac 2011, and Excel 2016 for Mac allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document, aka "Microsoft…