VYPR

CVEs

398,760 total · page 6422 of 7,976

AllCriticalHighKEV
  • CVE-2016-1365HigAug 18, 2016
    Cisco Systems, Inc.
    Application Policy Infrastructure Controller Enterprise Module
    risk 0.57cvss 8.8epss 0.03

    The Grapevine update process in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0 allows remote authenticated users to execute arbitrary commands as root via a crafted upgrade parameter, aka Bug ID CSCux15507.

  • CVE-2016-6367HigKEVAug 18, 2016
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.68cvss 7.8epss 0.23

    Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

  • CVE-2016-6366HigKEVAug 18, 2016
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.79cvss 8.8epss 0.88

    Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted…

  • CVE-2016-5847MedAug 13, 2016
    SAP
    Sapcar
    risk 0.41cvss 5.8epss 0.01

    SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain privileges via a hard link attack on files extracted from an archive, possibly related to SAP Security Note 2327384.

  • CVE-2016-5845MedAug 13, 2016
    SAP
    Sapcar
    risk 0.39cvss 5.5epss 0.03

    SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to cause a denial of service (program crash) via an invalid file name in an archive file, aka SAP Security Note 2312905.

  • CVE-2016-5384HigAug 13, 2016
    Fontconfig Project
    Fontconfig
    risk 0.51cvss 7.8epss 0.00

    fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.

  • CVE-2016-6214MedAug 12, 2016
    Libgd
    Libgd
    risk 0.43cvss 6.5epss 0.03

    gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.

  • CVE-2016-6207MedAug 12, 2016
    Libgd
    Libgd
    risk 0.36cvss 6.5epss 0.06

    Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or memory consumption) via unspecified vectors.

  • CVE-2016-6161MedAug 12, 2016
    Libgd
    Libgd
    risk 0.42cvss 6.5epss 0.03

    The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.

  • CVE-2016-6132MedAug 12, 2016
    Libgd
    Libgd
    risk 0.43cvss 6.5epss 0.03

    The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.

  • CVE-2016-6597HigAug 10, 2016
    Sophos
    EAS Proxy
    risk 0.56cvss 8.6epss 0.04

    Sophos EAS Proxy before 6.2.0 for Sophos Mobile Control, when Lotus Traveler is enabled, allows remote attackers to access arbitrary web-resources from the backend mail system via a request for the resource, aka an Open Reverse Proxy vulnerability.

  • CVE-2016-5421HigAug 10, 2016
    Curl
    Libcurl
    risk 0.46cvss 8.1epss 0.08

    Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.

  • CVE-2016-5420HigAug 10, 2016
    Curl
    Libcurl
    risk 0.50cvss 7.5epss 0.15

    curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

  • CVE-2016-5419HigAug 10, 2016
    Curl
    Libcurl
    risk 0.50cvss 7.5epss 0.15

    curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.

  • CVE-2016-5408CriAug 10, 2016
    Red Hat
    squid
    risk 0.64cvss 9.8epss 0.04

    Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: this vulnerability exists because of an…

  • CVE-2013-7458LowAug 10, 2016
    Redis
    Redis
    risk 0.14cvss 3.3epss 0.00

    linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.

  • CVE-2016-3329MedAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.36cvss 5.3epss 0.14

    Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to determine the existence of files via a crafted webpage, aka "Internet Explorer Information Disclosure Vulnerability."

  • CVE-2016-3327MedAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.36cvss 5.3epss 0.14

    Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page, aka "Microsoft Browser Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3326.

  • CVE-2016-3326MedAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.36cvss 5.3epss 0.16

    Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page, aka "Microsoft Browser Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3327.

  • CVE-2016-3322HigAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.14

    Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3289.

  • CVE-2016-3321LowAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.22cvss 2.5epss 0.36

    Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via vectors involving a file:// URL and an HTML5 sandbox iframe, aka "Internet Explorer Information…

  • CVE-2016-3320MedAug 9, 2016
    Microsoft
    Windows Server 2012
    risk 0.32cvss 4.9epss 0.05

    Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow attackers to bypass the Secure Boot protection mechanism by leveraging (1) administrative or (2) physical access to install a crafted boot manager, aka "Secure Boot…

  • CVE-2016-3319HigAug 9, 2016
    Microsoft
    Windows Server 2012
    risk 0.47cvss 7.0epss 0.19

    The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote Code Execution Vulnerability."

  • CVE-2016-3318HigAug 9, 2016
    Microsoft
    Office
    risk 0.52cvss 7.8epss 0.22

    Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allow remote attackers to execute arbitrary code via a crafted file, aka "Graphics Component Memory Corruption Vulnerability."

  • CVE-2016-3317HigAug 9, 2016
    Microsoft
    Word
    risk 0.52cvss 7.8epss 0.22

    Microsoft Office 2010 SP2, Word 2007 SP3, Word 2010 SP2, Word for Mac 2011, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-3316HigAug 9, 2016
    Microsoft
    Word
    risk 0.57cvss 7.8epss 0.47

    Microsoft Word 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-3315MedAug 9, 2016
    Microsoft
    Onenote
    risk 0.38cvss 5.5epss 0.30

    Microsoft OneNote 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to obtain sensitive information via a crafted OneNote file, aka "Microsoft OneNote Information Disclosure Vulnerability."

  • CVE-2016-3313HigAug 9, 2016
    Microsoft
    Office
    risk 0.58cvss 7.8epss 0.50

    Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-3312CriAug 9, 2016
    Microsoft
    Universal Outlook
    risk 0.60cvss 9.1epss 0.10

    ActiveSyncProvider in Microsoft Windows 10 Gold and 1511 allows attackers to discover credentials by leveraging failure of Universal Outlook to obtain a secure connection, aka "Universal Outlook Information Disclosure Vulnerability."

  • CVE-2016-3311HigAug 9, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.02

    The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka…

  • CVE-2016-3310HigAug 9, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.03

    The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka…

  • CVE-2016-3309HigKEVAug 9, 2016
    Microsoft
    Windows
    risk 0.73cvss 7.8epss 0.20

    The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka…

  • CVE-2016-3308HigAug 9, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.06

    The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka…

  • CVE-2016-3304HigAug 9, 2016
    Microsoft
    Office
    risk 0.58cvss 7.8epss 0.51

    The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers…

  • CVE-2016-3303HigAug 9, 2016
    Microsoft
    Office
    risk 0.58cvss 7.8epss 0.51

    The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers…

  • CVE-2016-3301HigAug 9, 2016
    Microsoft
    Office
    risk 0.57cvss 7.8epss 0.44

    The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for Business 2016; Lync…

  • CVE-2016-3300HigAug 9, 2016
    Microsoft
    Windows Server 2012
    risk 0.51cvss 7.8epss 0.01

    The Netlogon service in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 improperly establishes secure communications channels, which allows local users to gain privileges by leveraging access to a domain-joined machine, aka "Netlogon Elevation of…

  • CVE-2016-3299MedAug 9, 2016
    Microsoft
    Windows
    risk 0.36cvss 5.3epss 0.14

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow remote attackers to hijack network traffic or bypass intended Enhanced Protected Mode (EPM) or…

  • CVE-2016-3296HigAug 9, 2016
    Microsoft
    Edge
    risk 0.50cvss 7.5epss 0.15

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."

  • CVE-2016-3293HigAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.15

    Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulnerability."

  • CVE-2016-3290HigAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.16

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code via a crafted web page, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3288.

  • CVE-2016-3289HigAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.18

    Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3322.

  • CVE-2016-3288HigAug 9, 2016
    Microsoft
    Internet Explorer
    risk 0.56cvss 7.5epss 0.52

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code via a crafted web page, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3290.

  • CVE-2016-3237HigAug 9, 2016
    Microsoft
    Windows
    risk 0.53cvss 7.5epss 0.17

    Kerberos in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows man-in-the-middle attackers to bypass authentication via vectors related to a…

  • CVE-2016-4253MedAug 9, 2016
    Adobe Inc.
    Experience Manager
    risk 0.35cvss 5.3epss 0.03

    The Backup functionality in Adobe Experience Manager 5.6.1, 6.0, 6.1, and 6.2 allows attackers to obtain sensitive information via unspecified vectors.

  • CVE-2016-4170MedAug 9, 2016
    Adobe Inc.
    Experience Manager
    risk 0.40cvss 6.1epss 0.02

    Cross-site scripting (XSS) vulnerability in Adobe Experience Manager 5.6.1, 6.0, 6.1, and 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2016-4169MedAug 9, 2016
    Adobe Inc.
    Experience Manager
    risk 0.35cvss 5.3epss 0.03

    Adobe Experience Manager 6.0, 6.1, and 6.2 allow attackers to obtain sensitive audit log event information via unspecified vectors.

  • CVE-2016-4168MedAug 9, 2016
    Adobe Inc.
    Experience Manager
    risk 0.40cvss 6.1epss 0.02

    Cross-site scripting (XSS) vulnerability in Adobe Experience Manager 5.6.1, 6.0, and 6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2016-5878MedAug 8, 2016
    IBM
    Filenet Workplace
    risk 0.44cvss 6.8epss 0.01

    Open redirect vulnerability in IBM FileNet Workplace 4.0.2 before 4.0.2.14 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2016-5331MedAug 8, 2016
    VMware
    Esxi
    risk 0.40cvss 6.1epss 0.02

    CRLF injection vulnerability in VMware vCenter Server 6.0 before U2 and ESXi 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.