CVEs

399,020 total · page 6418 of 7,981

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	KEV	Published	Description
CVE-2016-4809	Libarchive Libarchive	Hig	0.49	7.5	0.05		Sep 21, 2016	The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.
CVE-2016-4302	Libarchive Libarchive	Hig	0.51	7.8	0.05		Sep 21, 2016	Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.
CVE-2016-4301	Libarchive Libarchive	Hig	0.51	7.8	0.04		Sep 21, 2016	Stack-based buffer overflow in the parse_device function in archive_read_support_format_mtree.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a crafted mtree file.
CVE-2016-4300	Libarchive Libarchive	Hig	0.51	7.8	0.05		Sep 21, 2016	Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.
CVE-2015-8871	Uclouvain Openjpeg	Cri	0.57	9.8	0.03		Sep 21, 2016	Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.
CVE-2016-6530	Dentsply Sirona Cdr Dicom	Cri	0.64	9.8	0.03		Sep 21, 2016	Dentsply Sirona (formerly Schick) CDR Dicom 5 and earlier has default passwords for the sa and cdr accounts, which allows remote attackers to obtain administrative access by leveraging knowledge of these passwords.
CVE-2016-4384	HPE LoadRunner	Hig	0.56	8.6	0.04		Sep 21, 2016	HPE Performance Center before 12.50 and LoadRunner before 12.50 allow remote attackers to cause a denial of service via unspecified vectors.
CVE-2016-4382	HPE Performance Center	Hig	0.54	8.3	0.02		Sep 21, 2016	HPE Performance Center 11.52, 12.00, 12.01, 12.20, and 12.50 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to a "remote user validation failure" issue.
CVE-2016-0925	EMC Corporation Rsa Adaptive Authentication On Premise	Med	0.35	5.4	0.01		Sep 21, 2016	Cross-site scripting (XSS) vulnerability in the Case Management application in EMC RSA Adaptive Authentication (On-Premise) before 6.0.2.1.SP3.P4 HF210, 7.0.x and 7.1.x before 7.1.0.0.SP0.P6 HF50, and 7.2.x before 7.2.0.0.SP0.P0 HF20 allows remote authenticated users to inject…
CVE-2016-0921	EMC Corporation Avamar Server	Med	0.42	6.5	0.00		Sep 21, 2016	Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use weak permissions for unspecified directories, which allows local users to obtain root access by replacing a script with a Trojan horse program.
CVE-2016-0920	EMC Corporation Avamar Server	Hig	0.51	7.8	0.00		Sep 21, 2016	Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 allow local users to obtain root access via a crafted parameter to a command that is available in the sudo configuration.
CVE-2016-0917	EMC Corporation VNXe3200 Operating Environment	Cri	0.64	9.8	0.04		Sep 21, 2016	The SMB service in EMC VNXe (VNXe3200 Operating Environment prior to 3.1.5.8711957 and VNXe3100/3150/3300 Operating Environment prior to 2.4.4.22638), VNX1 File OE before 7.1.80.3, VNX2 File OE before 8.1.9.155, and Celerra (all supported versions) does not prevent duplicate…
CVE-2016-0905	EMC Corporation Avamar Server	Med	0.44	6.7	0.00		Sep 21, 2016	Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 allow local users to obtain root privileges by leveraging admin access and entering a sudo command.
CVE-2016-0904	EMC Corporation Avamar Server	Hig	0.56	8.6	0.01		Sep 21, 2016	Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive client-server…
CVE-2016-0903	EMC Corporation Avamar Server	Cri	0.59	9.1	0.03		Sep 21, 2016	Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 rely on client-side authentication, which allows remote attackers to spoof clients and read backup data via a modified client agent.
CVE-2015-8960	TLS TLS	Hig	0.53	8.1	0.02		Sep 21, 2016	The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server…
CVE-2016-6802	Apache Shiro	Hig	0.43	7.5	0.10		Sep 20, 2016	Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
CVE-2016-6662	MariaDB MariaDB	Cri	0.72	9.8	0.68		Sep 20, 2016	Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary…
CVE-2015-8934	Libarchive Libarchive	Med	0.29	5.5	0.02		Sep 20, 2016	The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted rar file.
CVE-2015-8933	Libarchive Libarchive	Med	0.29	5.5	0.02		Sep 20, 2016	Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file.
CVE-2015-8932	Libarchive Libarchive	Med	0.29	5.5	0.02		Sep 20, 2016	The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file, which triggers an invalid left shift.
CVE-2015-8931	Libarchive Libarchive	Hig	0.44	7.8	0.02		Sep 20, 2016	Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior.
CVE-2015-8930	Libarchive Libarchive	Hig	0.42	7.5	0.04		Sep 20, 2016	bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself.
CVE-2015-8929	Libarchive Libarchive	Med	0.29	5.5	0.02		Sep 20, 2016	Memory leak in the __archive_read_get_extract function in archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service via a tar file.
CVE-2015-8928	Libarchive Libarchive	Med	0.29	5.5	0.02		Sep 20, 2016	The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
CVE-2015-8927	Libarchive Libarchive	Med	0.29	5.5	0.02		Sep 20, 2016	The trad_enc_decrypt_update function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted zip file, related to reading the password.
CVE-2015-8926	Libarchive Libarchive	Med	0.29	5.5	0.02		Sep 20, 2016	The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.
CVE-2015-8925	Libarchive Libarchive	Med	0.29	5.5	0.02		Sep 20, 2016	The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing.
CVE-2015-8924	Libarchive Libarchive	Med	0.29	5.5	0.05		Sep 20, 2016	The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file.
CVE-2015-8923	Libarchive Libarchive	Med	0.35	6.5	0.03		Sep 20, 2016	The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to cause a denial of service (crash) via a crafted zip file.
CVE-2015-8922	Libarchive Libarchive	Med	0.29	5.5	0.02		Sep 20, 2016	The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct.
CVE-2015-8921	Libarchive Libarchive	Hig	0.43	7.5	0.12		Sep 20, 2016	The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
CVE-2015-8920	Libarchive Libarchive	Med	0.29	5.5	0.02		Sep 20, 2016	The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file.
CVE-2015-8919	Libarchive Libarchive	Hig	0.42	7.5	0.05		Sep 20, 2016	The lha_read_file_extended_header function in archive_read_support_format_lha.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted (1) lzh or (2) lha file.
CVE-2015-8918	Libarchive Libarchive	Hig	0.42	7.5	0.04		Sep 20, 2016	The archive_string_append function in archive_string.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted cab files, related to "overlapping memcpy."
CVE-2015-8917	Libarchive Libarchive	Hig	0.42	7.5	0.04		Sep 20, 2016	bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.
CVE-2015-8916	Libarchive Libarchive	Med	0.36	6.5	0.03		Sep 20, 2016	bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file.
CVE-2015-8915	Libarchive Libarchive	Med	0.29	5.5	0.02		Sep 20, 2016	bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file.
CVE-2016-6537	AVer Information EH6108H+	Hig	0.49	7.5	0.01		Sep 19, 2016	AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent attacks to obtain sensitive information by reading these strings.
CVE-2016-6536	AVer Information EH6108H+	Cri	0.64	9.8	0.03		Sep 19, 2016	The /setup URI on AVer Information EH6108H+ devices with firmware X9.03.24.00.07l allows remote attackers to bypass intended page-access restrictions or modify passwords by leveraging knowledge of a handle parameter value.
CVE-2016-6535	AVer Information EH6108H+	Cri	0.64	9.8	0.02		Sep 19, 2016	AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access by leveraging knowledge of the credentials and establishing a TELNET session.
CVE-2016-6415	Cisco Systems, Inc. Cisco iOS	Hig	0.71	7.5	0.88	KEV	Sep 19, 2016	The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA)…
CVE-2016-5814	Rockwellautomation Rslogix Micro Starter Lite	Hig	0.56	8.6	0.05		Sep 19, 2016	Buffer overflow in Rockwell Automation RSLogix Micro Starter Lite, RSLogix Micro Developer, RSLogix 500 Starter Edition, RSLogix 500 Standard Edition, and RSLogix 500 Professional Edition allows remote attackers to execute arbitrary code via a crafted RSS project file.
CVE-2016-4860	Yokogawa Stardom Fcn\/fcj	Hig	0.48	7.3	0.03		Sep 19, 2016	Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections, which allows remote attackers to reconfigure the device or cause a denial of service via a (1) stop application program, (2) change value, or (3) modify…
CVE-2016-4526	Abb DataManagerPro	Hig	0.49	7.5	0.00		Sep 19, 2016	ABB DataManagerPro 1.x before 1.7.1 allows local users to gain privileges by replacing a DLL file in the package directory.
CVE-2016-1483	Cisco Systems, Inc. Webex Meetings Server	Hig	0.49	7.5	0.02		Sep 19, 2016	Cisco WebEx Meetings Server 2.6 allows remote attackers to cause a denial of service (CPU consumption) by repeatedly accessing the account-validation component of an unspecified service, aka Bug ID CSCuy92704.
CVE-2016-0870	Track\+ Tracer Sc	Med	0.35	5.3	0.01		Sep 19, 2016	The web server in Trane Tracer SC 4.2.1134 and earlier allows remote attackers to read sensitive configuration files via a direct request.
CVE-2016-6405	Cisco Systems, Inc. Fog Director	Med	0.42	6.5	0.01		Sep 18, 2016	Cisco Fog Director 1.0(0) for IOx allows remote authenticated users to bypass intended access restrictions and write to arbitrary files via the Cartridge interface, aka Bug ID CSCuz89368.
CVE-2016-6404	Cisco Systems, Inc. Cisco iOS	Med	0.40	6.1	0.01		Sep 18, 2016	Cross-site scripting (XSS) vulnerability in the web framework in Cisco IOx Local Manager in IOS 15.5(2)T and IOS XE allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy19854.
CVE-2016-6403	Cisco Systems, Inc. Cisco iOS	Med	0.38	5.9	0.02		Sep 18, 2016	The Data in Motion (DMo) application in Cisco IOS 15.6(1)T and IOS XE, when the IOx feature set is enabled, allows remote attackers to cause a denial of service via a crafted packet, aka Bug IDs CSCuy82904, CSCuy82909, and CSCuy82912.

CVE-2016-4809HigSep 21, 2016
Libarchive
Libarchive
risk 0.49cvss 7.5epss 0.05
The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.
CVE-2016-4302HigSep 21, 2016
Libarchive
Libarchive
risk 0.51cvss 7.8epss 0.05
Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.
CVE-2016-4301HigSep 21, 2016
Libarchive
Libarchive
risk 0.51cvss 7.8epss 0.04
Stack-based buffer overflow in the parse_device function in archive_read_support_format_mtree.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a crafted mtree file.
CVE-2016-4300HigSep 21, 2016
Libarchive
Libarchive
risk 0.51cvss 7.8epss 0.05
Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.
CVE-2015-8871CriSep 21, 2016
Uclouvain
Openjpeg
risk 0.57cvss 9.8epss 0.03
Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.
CVE-2016-6530CriSep 21, 2016
Dentsply Sirona
Cdr Dicom
risk 0.64cvss 9.8epss 0.03
Dentsply Sirona (formerly Schick) CDR Dicom 5 and earlier has default passwords for the sa and cdr accounts, which allows remote attackers to obtain administrative access by leveraging knowledge of these passwords.
CVE-2016-4384HigSep 21, 2016
HPE
LoadRunner
risk 0.56cvss 8.6epss 0.04
HPE Performance Center before 12.50 and LoadRunner before 12.50 allow remote attackers to cause a denial of service via unspecified vectors.
CVE-2016-4382HigSep 21, 2016
HPE
Performance Center
risk 0.54cvss 8.3epss 0.02
HPE Performance Center 11.52, 12.00, 12.01, 12.20, and 12.50 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to a "remote user validation failure" issue.
CVE-2016-0925MedSep 21, 2016
EMC Corporation
Rsa Adaptive Authentication On Premise
risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in the Case Management application in EMC RSA Adaptive Authentication (On-Premise) before 6.0.2.1.SP3.P4 HF210, 7.0.x and 7.1.x before 7.1.0.0.SP0.P6 HF50, and 7.2.x before 7.2.0.0.SP0.P0 HF20 allows remote authenticated users to inject…
CVE-2016-0921MedSep 21, 2016
EMC Corporation
Avamar Server
risk 0.42cvss 6.5epss 0.00
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use weak permissions for unspecified directories, which allows local users to obtain root access by replacing a script with a Trojan horse program.
CVE-2016-0920HigSep 21, 2016
EMC Corporation
Avamar Server
risk 0.51cvss 7.8epss 0.00
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 allow local users to obtain root access via a crafted parameter to a command that is available in the sudo configuration.
CVE-2016-0917CriSep 21, 2016
EMC Corporation
VNXe3200 Operating Environment
risk 0.64cvss 9.8epss 0.04
The SMB service in EMC VNXe (VNXe3200 Operating Environment prior to 3.1.5.8711957 and VNXe3100/3150/3300 Operating Environment prior to 2.4.4.22638), VNX1 File OE before 7.1.80.3, VNX2 File OE before 8.1.9.155, and Celerra (all supported versions) does not prevent duplicate…
CVE-2016-0905MedSep 21, 2016
EMC Corporation
Avamar Server
risk 0.44cvss 6.7epss 0.00
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 allow local users to obtain root privileges by leveraging admin access and entering a sudo command.
CVE-2016-0904HigSep 21, 2016
EMC Corporation
Avamar Server
risk 0.56cvss 8.6epss 0.01
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive client-server…
CVE-2016-0903CriSep 21, 2016
EMC Corporation
Avamar Server
risk 0.59cvss 9.1epss 0.03
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 rely on client-side authentication, which allows remote attackers to spoof clients and read backup data via a modified client agent.
CVE-2015-8960HigSep 21, 2016
TLS
TLS
risk 0.53cvss 8.1epss 0.02
The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server…
CVE-2016-6802HigSep 20, 2016
Apache
Shiro
risk 0.43cvss 7.5epss 0.10
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
CVE-2016-6662CriSep 20, 2016
MariaDB
MariaDB
risk 0.72cvss 9.8epss 0.68
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary…
CVE-2015-8934MedSep 20, 2016
Libarchive
Libarchive
risk 0.29cvss 5.5epss 0.02
The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted rar file.
CVE-2015-8933MedSep 20, 2016
Libarchive
Libarchive
risk 0.29cvss 5.5epss 0.02
Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file.
CVE-2015-8932MedSep 20, 2016
Libarchive
Libarchive
risk 0.29cvss 5.5epss 0.02
The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file, which triggers an invalid left shift.
CVE-2015-8931HigSep 20, 2016
Libarchive
Libarchive
risk 0.44cvss 7.8epss 0.02
Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior.
CVE-2015-8930HigSep 20, 2016
Libarchive
Libarchive
risk 0.42cvss 7.5epss 0.04
bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a member of itself.
CVE-2015-8929MedSep 20, 2016
Libarchive
Libarchive
risk 0.29cvss 5.5epss 0.02
Memory leak in the __archive_read_get_extract function in archive_read_extract2.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service via a tar file.
CVE-2015-8928MedSep 20, 2016
Libarchive
Libarchive
risk 0.29cvss 5.5epss 0.02
The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
CVE-2015-8927MedSep 20, 2016
Libarchive
Libarchive
risk 0.29cvss 5.5epss 0.02
The trad_enc_decrypt_update function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted zip file, related to reading the password.
CVE-2015-8926MedSep 20, 2016
Libarchive
Libarchive
risk 0.29cvss 5.5epss 0.02
The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.
CVE-2015-8925MedSep 20, 2016
Libarchive
Libarchive
risk 0.29cvss 5.5epss 0.02
The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing.
CVE-2015-8924MedSep 20, 2016
Libarchive
Libarchive
risk 0.29cvss 5.5epss 0.05
The archive_read_format_tar_read_header function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tar file.
CVE-2015-8923MedSep 20, 2016
Libarchive
Libarchive
risk 0.35cvss 6.5epss 0.03
The process_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to cause a denial of service (crash) via a crafted zip file.
CVE-2015-8922MedSep 20, 2016
Libarchive
Libarchive
risk 0.29cvss 5.5epss 0.02
The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct.
CVE-2015-8921HigSep 20, 2016
Libarchive
Libarchive
risk 0.43cvss 7.5epss 0.12
The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.
CVE-2015-8920MedSep 20, 2016
Libarchive
Libarchive
risk 0.29cvss 5.5epss 0.02
The _ar_read_header function in archive_read_support_format_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds stack read) via a crafted ar file.
CVE-2015-8919HigSep 20, 2016
Libarchive
Libarchive
risk 0.42cvss 7.5epss 0.05
The lha_read_file_extended_header function in archive_read_support_format_lha.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds heap) via a crafted (1) lzh or (2) lha file.
CVE-2015-8918HigSep 20, 2016
Libarchive
Libarchive
risk 0.42cvss 7.5epss 0.04
The archive_string_append function in archive_string.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted cab files, related to "overlapping memcpy."
CVE-2015-8917HigSep 20, 2016
Libarchive
Libarchive
risk 0.42cvss 7.5epss 0.04
bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.
CVE-2015-8916MedSep 20, 2016
Libarchive
Libarchive
risk 0.36cvss 6.5epss 0.03
bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file.
CVE-2015-8915MedSep 20, 2016
Libarchive
Libarchive
risk 0.29cvss 5.5epss 0.02
bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file.
CVE-2016-6537HigSep 19, 2016
AVer Information
EH6108H+
risk 0.49cvss 7.5epss 0.01
AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent attacks to obtain sensitive information by reading these strings.
CVE-2016-6536CriSep 19, 2016
AVer Information
EH6108H+
risk 0.64cvss 9.8epss 0.03
The /setup URI on AVer Information EH6108H+ devices with firmware X9.03.24.00.07l allows remote attackers to bypass intended page-access restrictions or modify passwords by leveraging knowledge of a handle parameter value.
CVE-2016-6535CriSep 19, 2016
AVer Information
EH6108H+
risk 0.64cvss 9.8epss 0.02
AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access by leveraging knowledge of the credentials and establishing a TELNET session.
CVE-2016-6415HigKEVSep 19, 2016
Cisco Systems, Inc.
Cisco iOS
risk 0.71cvss 7.5epss 0.88
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA)…
CVE-2016-5814HigSep 19, 2016
Rockwellautomation
Rslogix Micro Starter Lite
risk 0.56cvss 8.6epss 0.05
Buffer overflow in Rockwell Automation RSLogix Micro Starter Lite, RSLogix Micro Developer, RSLogix 500 Starter Edition, RSLogix 500 Standard Edition, and RSLogix 500 Professional Edition allows remote attackers to execute arbitrary code via a crafted RSS project file.
CVE-2016-4860HigSep 19, 2016
Yokogawa
Stardom Fcn\/fcj
risk 0.48cvss 7.3epss 0.03
Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections, which allows remote attackers to reconfigure the device or cause a denial of service via a (1) stop application program, (2) change value, or (3) modify…
CVE-2016-4526HigSep 19, 2016
Abb
DataManagerPro
risk 0.49cvss 7.5epss 0.00
ABB DataManagerPro 1.x before 1.7.1 allows local users to gain privileges by replacing a DLL file in the package directory.
CVE-2016-1483HigSep 19, 2016
Cisco Systems, Inc.
Webex Meetings Server
risk 0.49cvss 7.5epss 0.02
Cisco WebEx Meetings Server 2.6 allows remote attackers to cause a denial of service (CPU consumption) by repeatedly accessing the account-validation component of an unspecified service, aka Bug ID CSCuy92704.
CVE-2016-0870MedSep 19, 2016
Track\+
Tracer Sc
risk 0.35cvss 5.3epss 0.01
The web server in Trane Tracer SC 4.2.1134 and earlier allows remote attackers to read sensitive configuration files via a direct request.
CVE-2016-6405MedSep 18, 2016
Cisco Systems, Inc.
Fog Director
risk 0.42cvss 6.5epss 0.01
Cisco Fog Director 1.0(0) for IOx allows remote authenticated users to bypass intended access restrictions and write to arbitrary files via the Cartridge interface, aka Bug ID CSCuz89368.
CVE-2016-6404MedSep 18, 2016
Cisco Systems, Inc.
Cisco iOS
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in the web framework in Cisco IOx Local Manager in IOS 15.5(2)T and IOS XE allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy19854.
CVE-2016-6403MedSep 18, 2016
Cisco Systems, Inc.
Cisco iOS
risk 0.38cvss 5.9epss 0.02
The Data in Motion (DMo) application in Cisco IOS 15.6(1)T and IOS XE, when the IOx feature set is enabled, allows remote attackers to cause a denial of service via a crafted packet, aka Bug IDs CSCuy82904, CSCuy82909, and CSCuy82912.