VYPR

CVEs

398,523 total · page 6440 of 7,971

AllCriticalHighKEV
  • CVE-2016-1438HigJun 23, 2016
    Cisco Systems, Inc.
    Asyncos
    risk 0.49cvss 7.5epss 0.01

    Cisco AsyncOS 9.7.0-125 on Email Security Appliance (ESA) devices allows remote attackers to bypass intended spam filtering via crafted executable content in a ZIP archive, aka Bug ID CSCuy39210.

  • CVE-2016-1437MedJun 23, 2016
    Cisco Systems, Inc.
    Prime Collaboration Deployment
    risk 0.42cvss 6.5epss 0.01

    SQL injection vulnerability in the SQL database in Cisco Prime Collaboration Deployment before 11.5.1 allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuy92549.

  • CVE-2016-1436HigJun 23, 2016
    Cisco Systems, Inc.
    ASR 5000 Packet Data Network Gateway
    risk 0.49cvss 7.5epss 0.02

    The General Packet Radio Switching Tunneling Protocol 1 (aka GTPv1) implementation on Cisco ASR 5000 Packet Data Network Gateway devices before 19.4 allows remote attackers to cause a denial of service (Session Manager process restart) via a crafted GTPv1 packet, aka Bug ID…

  • CVE-2016-1435HigJun 23, 2016
    Cisco Systems, Inc.
    IP Phone 8800 Series Firmware
    risk 0.46cvss 7.0epss 0.00

    Cisco 8800 phones with software 11.0(1) do not properly enforce mounted-filesystem permissions, which allows local users to write to arbitrary files by leveraging shell access, aka Bug ID CSCuz03014.

  • CVE-2016-1434MedJun 23, 2016
    Cisco Systems, Inc.
    IP Phone 8800 Series Firmware
    risk 0.42cvss 6.5epss 0.01

    The license-certificate upload functionality on Cisco 8800 phones with software 11.0(1) allows remote authenticated users to delete arbitrary files via an invalid file, aka Bug ID CSCuz03010.

  • CVE-2016-1428MedJun 23, 2016
    Cisco Systems, Inc.
    iOS Xe
    risk 0.42cvss 6.5epss 0.01

    Double free vulnerability in Cisco IOS XE 3.15S, 3.16S, and 3.17S allows remote authenticated users to cause a denial of service (device restart) via a sequence of crafted SNMP read requests, aka Bug ID CSCux13174.

  • CVE-2016-0914MedJun 23, 2016
    EMC Corporation
    Documentum Administrator
    risk 0.41cvss 6.3epss 0.01

    EMC Documentum WebTop 6.8 before Patch 13 and 6.8.1 before Patch 02, Documentum Administrator 7.x before 7.2 Patch 13, Documentum Capital Projects 1.9 before Patch 23 and 1.10 before Patch 10, and Documentum TaskSpace 6.7 SP3 allow remote authenticated users to bypass intended…

  • CVE-2015-6289HigJun 23, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.04

    Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a denial of service (memory consumption) via crafted TCP packets on the SSH port, aka Bug ID CSCuu13476.

  • CVE-2016-2364HigJun 20, 2016
    Fonality
    Fonality
    risk 0.49cvss 7.5epss 0.02

    The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge…

  • CVE-2016-2363HigJun 20, 2016
    Fonality
    Fonality
    risk 0.51cvss 7.8epss 0.01

    Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obtain root access for unspecified command execution by leveraging access to the nobody account.

  • CVE-2016-2362CriJun 20, 2016
    Fonality
    Fonality
    risk 0.64cvss 9.8epss 0.02

    Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, which allows remote attackers to obtain access via a (1) FTP or (2) SSH connection.

  • CVE-2016-2178MedJun 20, 2016
    OpenSSL Project
    OpenSSL
    risk 0.29cvss 5.5epss 0.01

    The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

  • CVE-2016-2177CriJun 20, 2016
    OpenSSL Project
    OpenSSL
    risk 0.60cvss 9.8epss 0.45

    OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc…

  • CVE-2015-8289HigJun 20, 2016
    Netgear
    D3600
    risk 0.49cvss 7.5epss 0.02

    The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to discover the cleartext administrator password by reading the cgi-bin/passrec.asp HTML source code.

  • CVE-2015-8288MedJun 20, 2016
    Netgear
    D3600
    risk 0.39cvss 5.9epss 0.02

    NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of…

  • CVE-2016-4811MedJun 19, 2016
    NTT Broadband Platform
    Japan Connected-free Wi-Fi
    risk 0.36cvss 5.6epss 0.01

    The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.15.1 and earlier for Android and 1.13.0 and earlier for iOS allows man-in-the-middle attackers to obtain API access via unspecified vectors.

  • CVE-2016-4530MedJun 19, 2016
    Osisoft
    Pi SQL Data Access Server 2016
    risk 0.42cvss 6.5epss 0.01

    OSIsoft PI SQL Data Access Server (aka OLE DB) 2016 1.5 allows remote authenticated users to cause a denial of service (service outage and data loss) via a message.

  • CVE-2016-4518MedJun 19, 2016
    Osisoft
    Pi Server
    risk 0.42cvss 6.5epss 0.01

    OSIsoft PI AF Server before 2016 2.8.0 allows remote authenticated users to cause a denial of service (service outage) via a message.

  • CVE-2016-4514HigJun 19, 2016
    Moxa
    Pt 7728
    risk 0.50cvss 7.7epss 0.01

    Moxa PT-7728 devices with software 3.4 build 15081113 allow remote authenticated users to change the configuration via vectors involving a local proxy.

  • CVE-2016-1864MedJun 19, 2016
    Apple Inc.
    Safari
    risk 0.28cvss 4.3epss 0.02

    The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attackers to obtain sensitive information via a crafted URL.

  • CVE-2016-1862LowJun 19, 2016
    Apple Inc.
    OS X
    risk 0.21cvss 3.3epss 0.01

    Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than CVE-2016-1860.

  • CVE-2016-1861HigJun 19, 2016
    Nvidia
    Graphics Driver
    risk 0.54cvss 7.8epss 0.04

    The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1846.

  • CVE-2016-1860LowJun 19, 2016
    Apple Inc.
    OS X
    risk 0.21cvss 3.3epss 0.01

    Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than CVE-2016-1862.

  • CVE-2016-1196MedJun 19, 2016
    Cybozu
    Garoon
    risk 0.28cvss 4.3epss 0.01

    Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive Address Book information via an API call, a different vulnerability than CVE-2015-7776.

  • CVE-2016-1192MedJun 19, 2016
    Cybozu
    Garoon
    risk 0.28cvss 4.3epss 0.01

    Directory traversal vulnerability in the logging implementation in Cybozu Garoon 3.7 through 4.2 allows remote authenticated users to read a log file via unspecified vectors.

  • CVE-2016-1191MedJun 19, 2016
    Cybozu
    Garoon
    risk 0.35cvss 5.3epss 0.02

    Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified vectors.

  • CVE-2016-0912CriJun 19, 2016
    Dell
    Emc Data Domain OS
    risk 0.64cvss 9.8epss 0.03

    EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 allows remote authenticated users to bypass intended password-change restrictions by leveraging access to (1) a different account with the same role as a target account or (2) an account's session at an unattended workstation.

  • CVE-2016-0911HigJun 19, 2016
    Dell
    Emc Data Domain OS
    risk 0.53cvss 8.2epss 0.01

    EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 has a default no_root_squash option for NFS exports, which makes it easier for remote attackers to obtain filesystem access by leveraging client root privileges.

  • CVE-2016-0392HigJun 19, 2016
    IBM
    General Parallel File System
    risk 0.55cvss 8.4epss 0.01

    IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, as distributed in Spectrum Scale RAID, allows local users to gain privileges via a crafted parameter to a…

  • CVE-2015-7776MedJun 19, 2016
    Cybozu
    Garoon
    risk 0.28cvss 4.3epss 0.01

    Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, a different vulnerability than CVE-2016-1196.

  • CVE-2015-7462MedJun 19, 2016
    IBM
    Websphere Mq
    risk 0.29cvss 4.4epss 0.00

    IBM WebSphere MQ 8.0.0.4 on IBM i platforms allows local users to discover cleartext certificate-keystore passwords within MQ trace output by leveraging administrator privileges to execute the mqcertck program.

  • CVE-2016-1226MedJun 19, 2016
    Trend Micro
    Internet Security
    risk 0.40cvss 6.1epss 0.02

    Cross-site scripting (XSS) vulnerability in Trend Micro Internet Security 8 and 10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2016-1225MedJun 19, 2016
    Trend Micro
    Internet Security
    risk 0.43cvss 6.5epss 0.03

    Trend Micro Internet Security 8 and 10 allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2016-1197MedJun 19, 2016
    Cybozu
    Garoon
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7775.

  • CVE-2016-1195HigJun 19, 2016
    Cybozu
    Garoon
    risk 0.48cvss 7.4epss 0.02

    Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.

  • CVE-2015-7775MedJun 19, 2016
    Cybozu
    Garoon
    risk 0.35cvss 5.4epss 0.01

    Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-1197.

  • CVE-2016-4821MedJun 19, 2016
    I-O DATA
    ETX-R
    risk 0.35cvss 5.3epss 0.02

    I-O DATA DEVICE ETX-R devices allow remote attackers to cause a denial of service (web-server crash) via unspecified vectors.

  • CVE-2016-4820HigJun 19, 2016
    I-O DATA
    ETX-R
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE ETX-R devices allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2016-4819CriJun 19, 2016
    Takumi Yamada
    DX Library
    risk 0.64cvss 9.8epss 0.04

    The printfDx function in Takumi Yamada DX Library for Borland C++ 3.13f through 3.16b, DX Library for Gnu C++ 3.13f through 3.16b, and DX Library for Visual C++ 3.13f through 3.16b allows remote attackers to execute arbitrary code via a crafted string.

  • CVE-2016-4817HigJun 19, 2016
    H2o Project
    H2o
    risk 0.49cvss 7.5epss 0.04

    lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet.

  • CVE-2016-4816MedJun 19, 2016
    Buffalotech
    WZR-S600DHP
    risk 0.42cvss 6.5epss 0.01

    BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other sensitive information via unspecified vectors.

  • CVE-2016-4815HigJun 19, 2016
    Buffalotech
    WZR-S600DHP
    risk 0.49cvss 7.5epss 0.02

    Directory traversal vulnerability on BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices with firmware 2.16 and earlier allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2016-4814HigJun 19, 2016
    Geospatial Information Authority Of Japan
    Old_GSI_Maps
    risk 0.49cvss 7.5epss 0.02

    Directory traversal vulnerability in kml2jsonp.php in Geospatial Information Authority of Japan (aka GSI) Old_GSI_Maps before January 2015 on Windows allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2016-4813HigJun 19, 2016
    Netcommons
    Netcommons
    risk 0.57cvss 8.8epss 0.02

    NetCommons 2.4.2.1 and earlier allows remote authenticated secretariat (aka CLERK) users to gain privileges by creating a SYSTEM_ADMIN account.

  • CVE-2016-4371HigJun 19, 2016
    HPE
    Service Manager
    risk 0.52cvss 8.0epss 0.01

    HPE Service Manager Software 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote authenticated users to obtain sensitive information, modify data, and conduct server-side request forgery (SSRF) attacks via unspecified vectors, related to the Server, Web Client,…

  • CVE-2016-1424MedJun 19, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.42cvss 6.5epss 0.01

    Cisco IOS 15.2(1)T1.11 and 15.2(2)TST allows remote attackers to cause a denial of service (device crash) via a crafted LLDP packet, aka Bug ID CSCun63132.

  • CVE-2016-1397MedJun 19, 2016
    Cisco Systems, Inc.
    Rv110w
    risk 0.42cvss 6.5epss 0.02

    Buffer overflow in the web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote authenticated users to cause a denial of service (device…

  • CVE-2016-1396MedJun 19, 2016
    Cisco Systems, Inc.
    Rv110w
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote attackers to inject arbitrary web…

  • CVE-2016-1395CriJun 19, 2016
    Cisco Systems, Inc.
    Rv110w
    risk 0.64cvss 9.8epss 0.05

    The web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote attackers to execute arbitrary code as root via a crafted HTTP request, aka Bug ID…

  • CVE-2016-1224MedJun 19, 2016
    Trend Micro
    Worry Free Business Security
    risk 0.40cvss 6.1epss 0.02

    CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting (XSS) attacks via unspecified vectors.