VYPR

CVEs

398,512 total · page 6448 of 7,971

AllCriticalHighKEV
  • CVE-2016-0879HigMay 31, 2016
    Moxa
    Secure Router EDR-G903
    risk 0.49cvss 7.5epss 0.02

    Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting these files at an unspecified URL.

  • CVE-2016-0878HigMay 31, 2016
    Moxa
    Secure Router EDR-G903
    risk 0.49cvss 7.5epss 0.02

    Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to cause a denial of service (cold start) by sending two crafted ping requests.

  • CVE-2016-0877HigMay 31, 2016
    Moxa
    EDR G903 Firmware
    risk 0.49cvss 7.5epss 0.02

    Memory leak on Moxa Secure Router EDR-G903 devices before 3.4.12 allows remote attackers to cause a denial of service (memory consumption) by executing the ping function.

  • CVE-2016-0876HigMay 31, 2016
    Moxa
    Secure Router EDR-G903
    risk 0.49cvss 7.5epss 0.01

    Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file.

  • CVE-2016-0875HigMay 31, 2016
    Moxa
    Secure Router EDR-G903
    risk 0.49cvss 7.5epss 0.02

    Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to read configuration and log files via a crafted URL.

  • CVE-2016-4118HigMay 30, 2016
    Adobe Inc.
    Connect
    risk 0.51cvss 7.8epss 0.01

    Untrusted search path vulnerability in the installer in Adobe Connect Add-In before 11.9.976.291 on Windows allows local users to gain privileges via unspecified vectors.

  • CVE-2016-2311MedMay 30, 2016
    Psf
    Black
    risk 0.42cvss 6.5epss 0.01

    Black Box AlertWerks ServSensor with firmware before SP473, AlertWerks ServSensor Junior with firmware before SP473, AlertWerks ServSensor Junior with PoE with firmware before SP473, and AlertWerks ServSensor Contact with firmware before SP473 allow remote authenticated users to…

  • CVE-2016-2309HigMay 30, 2016
    Irz
    Ruh2
    risk 0.47cvss 7.2epss 0.01

    iRZ RUH2 before 2b does not validate firmware patches, which allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.

  • CVE-2016-2025HigMay 30, 2016
    HPE
    Service Manager
    risk 0.49cvss 7.5epss 0.04

    HPE Service Manager 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote attackers to obtain sensitive information via unspecified vectors, related to the Web Client, Service Request Catalog, and Mobility components.

  • CVE-2016-2023MedMay 30, 2016
    HPE
    RESTful Interface Tool
    risk 0.36cvss 5.5epss 0.00

    HPE RESTful Interface Tool 1.40 allows local users to obtain sensitive information via unspecified vectors.

  • CVE-2016-1999CriMay 30, 2016
    Microfocus
    Release Control
    risk 0.64cvss 9.8epss 0.06

    The server in HP Release Control 9.13, 9.20, and 9.21 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

  • CVE-2016-0907MedMay 30, 2016
    EMC Corporation
    Isilon Onefs
    risk 0.38cvss 5.9epss 0.01

    EMC Isilon OneFS 7.1.x and 7.2.x before 7.2.1.3 and 8.0.x before 8.0.0.1, and IsilonSD Edge OneFS 8.0.x before 8.0.0.1, does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the…

  • CVE-2016-1409HigMay 29, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.04

    The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS XE 2.1 through 3.17S, IOS XR 2.0.0 through 5.3.2, and NX-OS allows remote attackers to cause a denial of service (packet-processing outage) via crafted ND messages, aka Bug ID CSCuz66542, as…

  • CVE-2016-1404HigMay 29, 2016
    Cisco Systems, Inc.
    UCS Invicta
    risk 0.49cvss 7.5epss 0.01

    Cisco UCS Invicta 4.3, 4.5, and 5.0.1 on Invicta appliances and Invicta Scaling System uses the same hardcoded GnuPG encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by sniffing network traffic…

  • CVE-2016-1413MedMay 28, 2016
    Cisco Systems, Inc.
    Secure Firewall Management Center
    risk 0.42cvss 6.5epss 0.01

    The web interface in Cisco Firepower Management Center 5.4.0 through 6.0.0.1 allows remote authenticated users to modify pages by placing crafted code in a parameter value, aka Bug ID CSCuy76517.

  • CVE-2016-1410HigMay 28, 2016
    Cisco Systems, Inc.
    Webex Meeting Center
    risk 0.49cvss 7.5epss 0.02

    Cisco WebEx Meeting Center Original Release Base allows remote attackers to obtain sensitive information about username validity by (1) attending or (2) hosting a meeting, aka Bug ID CSCux84312.

  • CVE-2016-1379MedMay 28, 2016
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.42cvss 6.5epss 0.01

    Cisco Adaptive Security Appliance (ASA) Software 9.0 through 9.5.1 mishandles IPsec error processing, which allows remote authenticated users to cause a denial of service (memory consumption) via crafted (1) LAN-to-LAN or (2) Remote Access VPN tunnel packets, aka Bug ID…

  • CVE-2016-3681HigMay 26, 2016
    Huawei
    Mate 8 Firmware
    risk 0.51cvss 7.8epss 0.01

    Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (crash) or possibly gain privileges via a crafted…

  • CVE-2016-3680HigMay 26, 2016
    Huawei
    Mate 8 Firmware
    risk 0.51cvss 7.8epss 0.01

    Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (crash) or possibly gain privileges via a crafted…

  • CVE-2016-0718CriMay 26, 2016
    Libexpat Project
    Expat
    risk 0.58cvss 9.8epss 0.13

    Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

  • CVE-2016-1385MedMay 26, 2016
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.42cvss 6.5epss 0.01

    The XML parser in Cisco Adaptive Security Appliance (ASA) Software through 9.5.2 allows remote authenticated users to cause a denial of service (instability, memory consumption, or device reload) by leveraging (1) administrative access or (2) Clientless SSL VPN access to provide…

  • CVE-2015-7360MedMay 26, 2016
    Fortinet
    Fortisandbox
    risk 0.40cvss 6.1epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface (WebUI) in Fortinet FortiSandbox before 2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) serial parameter to alerts/summary/profile/; the (2) urlForCreatingReport parameter…

  • CVE-2016-4792MedMay 26, 2016
    Ivanti
    Connect Secure
    risk 0.35cvss 5.3epss 0.02

    Pulse Connect Secure (PCS) 8.2 before 8.2r1 allows remote attackers to disclose sign in pages via unspecified vectors.

  • CVE-2016-4791HigMay 26, 2016
    Ivanti
    Connect Secure
    risk 0.56cvss 8.6epss 0.02

    The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to enumerate files, read arbitrary files, and conduct server side request forgery (SSRF) attacks via…

  • CVE-2016-4790MedMay 26, 2016
    Ivanti
    Connect Secure
    risk 0.36cvss 5.5epss 0.01

    Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2016-4789MedMay 26, 2016
    Ivanti
    Connect Secure
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or…

  • CVE-2016-4788MedMay 26, 2016
    Ivanti
    Connect Secure
    risk 0.38cvss 5.8epss 0.02

    Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read an unspecified system file via unknown vectors.

  • CVE-2016-4787CriMay 26, 2016
    Ivanti
    Connect Secure
    risk 0.65cvss 10.0epss 0.02

    Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in an unspecified directory via unknown vectors.

  • CVE-2016-4786HigMay 26, 2016
    Ivanti
    Connect Secure
    risk 0.49cvss 7.5epss 0.02

    Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.

  • CVE-2016-4021HigMay 26, 2016
    Pgpdump Project
    Pgpdump
    risk 0.49cvss 7.5epss 0.02

    The read_binary function in buffer.c in pgpdump before 0.30 allows context-dependent attackers to cause a denial of service (infinite loop and CPU consumption) via crafted input, as demonstrated by the \xa3\x03 string.

  • CVE-2016-2784MedMay 26, 2016
    Cmsmadesimple
    Cmsmadesimple
    risk 0.34cvss 4.7epss 0.02

    CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.

  • CVE-2016-4575MedMay 25, 2016
    Huawei
    Ath
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the email APP in Huawei PLK smartphones with software AL10C00 before AL10C00B211 and AL10C92 before AL10C92B211; ATH smartphones with software AL00C00 before AL00C00B361, CL00C92 before CL00C92B361, TL00HC01 before TL00HC01B361, and…

  • CVE-2016-4020MedMay 25, 2016
    QEMU
    Qemu
    risk 0.42cvss 6.5epss 0.00

    The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).

  • CVE-2016-1887HigMay 25, 2016
    FreeBSD
    FreeBSD
    risk 0.54cvss 7.8epss 0.01

    Integer signedness error in the sockargs function in sys/kern/uipc_syscalls.c in FreeBSD 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to cause a denial of service (memory overwrite and kernel panic) or gain privileges via a negative buflen argument,…

  • CVE-2016-1886HigMay 25, 2016
    FreeBSD
    FreeBSD
    risk 0.54cvss 7.8epss 0.01

    Integer signedness error in the genkbd_commonioctl function in sys/dev/kbd/kbd.c in FreeBSD 9.3 before p42, 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory overwrite and…

  • CVE-2015-8853HigMay 25, 2016
    Perl Foundation
    Perl
    risk 0.49cvss 7.5epss 0.03

    The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

  • CVE-2014-3672MedMay 25, 2016
    Xen
    Xen
    risk 0.42cvss 6.5epss 0.00

    The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr.

  • CVE-2016-1407HigMay 25, 2016
    Cisco Systems, Inc.
    iOS Xr
    risk 0.49cvss 7.5epss 0.02

    Cisco IOS XR through 5.3.2 mishandles Local Packet Transport Services (LPTS) flow-base entries, which allows remote attackers to cause a denial of service (session drop) by making many connection attempts to open TCP ports, aka Bug ID CSCux95576.

  • CVE-2016-1406HigMay 25, 2016
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.57cvss 8.8epss 0.02

    The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON…

  • CVE-2016-1400HigMay 25, 2016
    Cisco Systems, Inc.
    Telepresence Video Communication Server
    risk 0.49cvss 7.5epss 0.02

    Cisco TelePresence Video Communications Server (VCS) X8.x before X8.7.2 allows remote attackers to cause a denial of service (service disruption) via a crafted URI in a SIP header, aka Bug ID CSCuy43258.

  • CVE-2016-1383HigMay 25, 2016
    Cisco Systems, Inc.
    Web Security Appliance
    risk 0.49cvss 7.5epss 0.01

    Memory leak in Cisco AsyncOS through 8.8 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via an unspecified HTTP status code, aka Bug ID CSCur28305.

  • CVE-2016-1382HigMay 25, 2016
    Cisco Systems, Inc.
    Web Security Appliance
    risk 0.49cvss 7.5epss 0.02

    Cisco AsyncOS before 8.5.3-069 and 8.6 through 8.8 on Web Security Appliance (WSA) devices mishandles memory allocation for HTTP requests, which allows remote attackers to cause a denial of service (proxy-process reload) via a crafted request, aka Bug ID CSCuu02529.

  • CVE-2016-1381HigMay 25, 2016
    Cisco Systems, Inc.
    Web Security Appliance
    risk 0.49cvss 7.5epss 0.01

    Memory leak in Cisco AsyncOS 8.5 through 9.0 before 9.0.1-162 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via an HTTP file-range request for cached content, aka Bug ID CSCuw97270.

  • CVE-2016-1380HigMay 25, 2016
    Cisco Systems, Inc.
    Web Security Appliance
    risk 0.49cvss 7.5epss 0.01

    Cisco AsyncOS 8.0 before 8.0.6-119 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (proxy-process hang) via a crafted HTTP POST request, aka Bug ID CSCuo12171.

  • CVE-2016-0264MedMay 24, 2016
    IBM
    Java
    risk 0.37cvss 5.6epss 0.04

    Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) allows remote attackers to execute…

  • CVE-2016-4783MedMay 23, 2016
    Lenovo
    Shareit
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Lenovo SHAREit before 3.5.98_ww on Android before 4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."

  • CVE-2016-4782HigMay 23, 2016
    Lenovo
    Shareit
    risk 0.57cvss 8.8epss 0.02

    Lenovo SHAREit before 3.5.98_ww on Android before 4.2 allows remote attackers to have unspecified impact via a crafted intent: URL, aka an "intent scheme URL attack."

  • CVE-2016-4577HigMay 23, 2016
    Huawei
    Ngfw Module
    risk 0.49cvss 7.5epss 0.01

    Buffer overflow in the Smart DNS functionality in the Huawei NGFW Module and Secospace USG6300, USG6500, USG6600, and USG9500 firewalls with software before V500R001C20SPC100 allows remote attackers to cause a denial of service or execute arbitrary code via a crafted packet,…

  • CVE-2016-4576CriMay 23, 2016
    Huawei
    Ngfw Module
    risk 0.64cvss 9.8epss 0.02

    Buffer overflow in the Application Specific Packet Filtering (ASPF) functionality in the Huawei IPS Module, NGFW Module, NIP6300, NIP6600, Secospace USG6300, USG6500, USG6600, USG9500, and AntiDDoS8000 devices with software before V500R001C20SPC100 allows remote attackers to…

  • CVE-2016-4087HigMay 23, 2016
    Huawei
    S5700
    risk 0.53cvss 8.1epss 0.01

    Huawei S12700 switches with software before V200R008C00SPC500 and S5700 switches with software before V200R005SPH010, when the debug switch is enabled, allows remote attackers to cause a denial of service or execute arbitrary code via crafted DNS packets.