VYPR

CVEs

398,799 total · page 6421 of 7,976

AllCriticalHighKEV
  • CVE-2016-5679HigAug 31, 2016
    Netgear
    Readynas Surveillance
    risk 0.61cvss 8.8epss 0.14

    cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the sn parameter to the transfer_license command.

  • CVE-2016-5678CriAug 31, 2016
    Nuuo
    Nvrmini 2
    risk 0.67cvss 9.8epss 0.09

    NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative access via unspecified vectors.

  • CVE-2016-5677HigAug 31, 2016
    Netgear
    Readynas Surveillance
    risk 0.53cvss 7.5epss 0.12

    NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php…

  • CVE-2016-5676HigAug 31, 2016
    Netgear
    Readynas Surveillance
    risk 0.56cvss 7.5epss 0.54

    cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action.

  • CVE-2016-5675CriAug 31, 2016
    Netgear
    Readynas Surveillance
    risk 0.72cvss 9.8epss 0.71

    handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.

  • CVE-2016-5674CriAug 31, 2016
    Netgear
    Readynas Surveillance
    risk 0.74cvss 9.8epss 0.95

    __debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.

  • CVE-2016-7119MedAug 31, 2016
    Dnnsoftware
    Dotnetnuke
    risk 0.35cvss 5.4epss 0.01

    Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.

  • CVE-2016-7118MedAug 31, 2016
    Debian
    linux
    risk 0.36cvss 5.5epss 0.00

    fs/fcntl.c in the "aufs 3.2.x+setfl-debian" patch in the linux-image package 3.2.0-4 (kernel 3.2.81-1) in Debian wheezy mishandles F_SETFL fcntl calls on directories, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via standard…

  • CVE-2016-5336CriAug 31, 2016
    VMware
    Vrealize Automation
    risk 0.64cvss 9.8epss 0.03

    VMware vRealize Automation 7.0.x before 7.1 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2016-5335HigAug 31, 2016
    VMware
    Vrealize Automation
    risk 0.51cvss 7.8epss 0.00

    VMware Identity Manager 2.x before 2.7 and vRealize Automation 7.0.x before 7.1 allow local users to obtain root access via unspecified vectors.

  • CVE-2016-5333CriAug 31, 2016
    VMware
    Photos OS OVA
    risk 0.64cvss 9.8epss 0.03

    VMware Photos OS OVA 1.0 before 2016-08-14 has a default SSH public key in an authorized_keys file, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key.

  • CVE-2016-5332MedAug 31, 2016
    VMware
    Vrealize Log Insight
    risk 0.35cvss 5.3epss 0.03

    Directory traversal vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.6.0 allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2016-6195CriAug 30, 2016
    Jelsoft
    Vbulletin
    risk 0.72cvss 9.8epss 0.68

    SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via the postids parameter to forumrunner/request.php, as exploited in the wild in…

  • CVE-2016-7115CriAug 30, 2016
    Haakonnessjoen
    MAC-Telnet
    risk 0.64cvss 9.8epss 0.05

    Buffer overflow in the handle_packet function in mactelnet.c in the client in MAC-Telnet 0.4.3 and earlier allows remote TELNET servers to execute arbitrary code via a long string in an MT_CPTYPE_PASSSALT control packet.

  • CVE-2016-5344CriAug 30, 2016
    Linux
    Kernel
    risk 0.64cvss 9.8epss 0.02

    Multiple integer overflows in the MDSS driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service or possibly have unspecified other impact via a large size…

  • CVE-2016-5342HigAug 30, 2016
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.01

    Heap-based buffer overflow in the wcnss_wlan_write function in drivers/net/wireless/wcnss/wcnss_wlan.c in the wcnss_wlan device driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows…

  • CVE-2016-0397MedAug 30, 2016
    IBM
    Bigfix Platform
    risk 0.38cvss 5.9epss 0.01

    WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.5.2 allows remote attackers to obtain sensitive information by sniffing the network for HTTP traffic.

  • CVE-2016-0292MedAug 30, 2016
    IBM
    Bigfix
    risk 0.36cvss 5.5epss 0.00

    WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.5.2 allows local users to discover the cleartext system password by reading a report.

  • CVE-2016-5721MedAug 29, 2016
    Zimbra
    Collaboration Server
    risk 0.40cvss 6.1epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-5399MedAug 26, 2016
    Phpvibe
    Phpvibe
    risk 0.38cvss 5.4epss 0.02

    Cross-site scripting (XSS) vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment.

  • CVE-2016-5683HigAug 26, 2016
    Readydesk
    Readydesk
    risk 0.51cvss 7.8epss 0.00

    ReadyDesk 9.1 allows local users to determine cleartext SQL Server credentials by reading the SQL_Config.aspx file and decrypting data with a hardcoded key in the ReadyDesk.dll file.

  • CVE-2016-5664MedAug 26, 2016
    Accellion
    Kiteworks Appliance
    risk 0.28cvss 4.3epss 0.02

    Directory traversal vulnerability on Accellion Kiteworks appliances before kw2016.03.00 allows remote attackers to read files via a crafted URI.

  • CVE-2016-5663MedAug 26, 2016
    Accellion
    Kiteworks Appliance
    risk 0.40cvss 6.1epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in oauth_callback.php on Accellion Kiteworks appliances before kw2016.03.00 allow remote attackers to inject arbitrary web script or HTML via the (1) code, (2) error, or (3) error_description parameter.

  • CVE-2016-5662HigAug 26, 2016
    Accellion
    Kiteworks Appliance
    risk 0.51cvss 7.8epss 0.00

    Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, which allows local users to gain privileges via unspecified vectors.

  • CVE-2016-5050CriAug 26, 2016
    Readydesk
    Readydesk
    risk 0.64cvss 9.8epss 0.03

    Unrestricted file upload vulnerability in chat/sendfile.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary code by uploading and requesting a .aspx file.

  • CVE-2016-5049HigAug 26, 2016
    Readydesk
    Readydesk
    risk 0.49cvss 7.5epss 0.02

    Directory traversal vulnerability in chat/openattach.aspx in ReadyDesk 9.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the SESID parameter in conjunction with a filename in the FNAME parameter.

  • CVE-2016-5048CriAug 26, 2016
    Readydesk
    Readydesk
    risk 0.64cvss 9.8epss 0.02

    SQL injection vulnerability in chat/staff/default.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary SQL commands via the user name field.

  • CVE-2016-4378HigAug 26, 2016
    HPE
    Xp7 Command View Advanced Edition Suite
    risk 0.49cvss 7.5epss 0.03

    The (1) Device Manager, (2) Tiered Storage Manager, (3) Replication Manager, (4) Replication Monitor, and (5) Hitachi Automation Director (HAD) components in HPE XP P9000 Command View Advanced Edition Software before 8.4.1-00 and XP7 Command View Advanced Edition Suite before…

  • CVE-2016-4270CriAug 26, 2016
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.06

    Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2016-4269CriAug 26, 2016
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.06

    Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2016-4268CriAug 26, 2016
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.06

    Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2016-4267CriAug 26, 2016
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.06

    Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2016-4266CriAug 26, 2016
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.06

    Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2016-4265CriAug 26, 2016
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.06

    Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2016-4119CriAug 26, 2016
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.04

    Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2016-5383HigAug 26, 2016
    Red Hat
    Cloudforms
    risk 0.57cvss 8.8epss 0.03

    The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters."

  • CVE-2016-5023HigAug 26, 2016
    F5, Inc.
    Big IP
    risk 0.49cvss 7.5epss 0.03

    Virtual servers in F5 BIG-IP systems 11.2.1 HF11 through HF15, 11.4.1 HF4 through HF10, 11.5.3 through 11.5.4, 11.6.0 HF5 through HF7, and 12.0.0, when configured with a TCP profile, allow remote attackers to cause a denial of service (Traffic Management Microkernel restart) via…

  • CVE-2016-1497MedAug 26, 2016
    F5, Inc.
    Big IP
    risk 0.32cvss 4.9epss 0.02

    The Configuration utility in F5 BIG-IP systems 11.0.x, 11.1.x, 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4 HF2, 1.6.x before 11.6.1, and 12.0.0 before HF1 allows remote administrators to read Access Policy Manager (APM) access logs via…

  • CVE-2016-6369HigAug 25, 2016
    Cisco Systems, Inc.
    Anyconnect Secure Mobility Client
    risk 0.51cvss 7.8epss 0.00

    Cisco AnyConnect Secure Mobility Client before 4.2.05015 and 4.3.x before 4.3.02039 mishandles pathnames, which allows local users to gain privileges via a crafted INF file, aka Bug ID CSCuz92464.

  • CVE-2016-5681CriAug 25, 2016
    Dlink
    DIR-850L
    risk 0.65cvss 9.8epss 0.12

    Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx before 2.05b03beta03, DIR-822 C1 3.01 before 3.01WWb02, DIR-823 A1 1.00 before 1.00WWb05, DIR-895L A1 1.11 before 1.11WWb04, DIR-890L A1 1.09 before 1.09b14,…

  • CVE-2016-5673HigAug 25, 2016
    Ultravnc
    Repeater
    risk 0.49cvss 7.5epss 0.02

    UltraVNC Repeater before 1300 does not restrict destination IP addresses or TCP ports, which allows remote attackers to obtain open-proxy functionality by using a :: substring in between the IP address and port number.

  • CVE-2016-4657HigKEVAug 25, 2016
    Apple Inc.
    iOS
    risk 0.78cvss 8.8epss 0.67

    WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2016-4656HigKEVAug 25, 2016
    Apple Inc.
    iOS
    risk 0.68cvss 7.8epss 0.24

    The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-4655MedKEVAug 25, 2016
    Apple Inc.
    iOS
    risk 0.53cvss 5.5epss 0.33

    The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

  • CVE-2016-6231MedAug 25, 2016
    Kaspersky Lab
    Safe Browser
    risk 0.38cvss 5.9epss 0.01

    Kaspersky Safe Browser iOS before 1.7.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.

  • CVE-2016-4069HigAug 25, 2016
    Roundcube
    Webmail
    risk 0.57cvss 8.8epss 0.03

    Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download attachments and cause a denial of service (disk consumption) via unspecified vectors.

  • CVE-2016-7089HigAug 24, 2016
    WatchGuard
    RapidStream
    risk 0.54cvss 7.8epss 0.01

    WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command, aka ESCALATEPLOWMAN.

  • CVE-2016-6909CriAug 24, 2016
    Fortinet
    Fortios
    risk 0.71cvss 9.8epss 0.50

    Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request, aka EGREGIOUSBLUNDER.

  • CVE-2016-5812LowAug 24, 2016
    Moxa
    OnCell G3100V2
    risk 0.21cvss 3.3epss 0.00

    Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 use cleartext password storage, which makes it easier for local users to obtain sensitive information by reading a configuration file.

  • CVE-2016-5799CriAug 24, 2016
    Moxa
    OnCell G3100V2
    risk 0.64cvss 9.8epss 0.04

    Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do not properly restrict authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.