VYPR

CVEs

397,995 total · page 6462 of 7,960

AllCriticalHighKEV
  • CVE-2016-2290HigApr 6, 2016
    Pro Face
    GP-Pro EX EX-ED
    risk 0.57cvss 8.8epss 0.02

    Heap-based buffer overflow in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2016-2277MedApr 6, 2016
    Rockwellautomation
    Integrated Architecture Builder
    risk 0.41cvss 6.3epss 0.01

    IAB.exe in Rockwell Automation Integrated Architecture Builder (IAB) before 9.6.0.8 and 9.7.x before 9.7.0.2 allows remote attackers to execute arbitrary code via a crafted project file.

  • CVE-2016-2272HigApr 6, 2016
    Eaton
    Eg2 Web Control
    risk 0.49cvss 7.5epss 0.01

    Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to have an unspecified impact via a modified cookie.

  • CVE-2016-1346MedApr 6, 2016
    Samsung Mobile
    X14j Firmware
    risk 0.38cvss 5.9epss 0.02

    The kernel in Cisco TelePresence Server 3.0 through 4.2(4.18) on Mobility Services Engine (MSE) 8710 devices allows remote attackers to cause a denial of service (panic and reboot) via a crafted sequence of IPv6 packets, aka Bug ID CSCuu46673.

  • CVE-2016-1313CriApr 6, 2016
    Cisco Systems, Inc.
    Ucs Invicta C3124sa Appliance
    risk 0.64cvss 9.8epss 0.03

    Cisco UCS Invicta C3124SA Appliance 4.3.1 through 5.0.1, UCS Invicta Scaling System and Appliance, and Whiptail Racerunner improperly store a default SSH private key, which allows remote attackers to obtain root access via unspecified vectors, aka Bug ID CSCun71294.

  • CVE-2016-1291CriApr 6, 2016
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.64cvss 9.8epss 0.07

    Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allow remote attackers to execute arbitrary code via crafted deserialized data in an HTTP POST request, aka Bug ID CSCuw03192.

  • CVE-2016-1290HigApr 6, 2016
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.53cvss 8.1epss 0.01

    The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka…

  • CVE-2016-1174HigApr 6, 2016
    Hiniarata
    Casebook Plugin
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Menubook plugin before 0.9.3 for baserCMS allows remote attackers to hijack the authentication of administrators.

  • CVE-2016-1173MedApr 6, 2016
    Basercms
    Basercms
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the Menubook plugin before 0.9.3 for baserCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2016-1172HigApr 6, 2016
    Basercms
    Basercms
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Recruit plugin before 0.9.3 for baserCMS allows remote attackers to hijack the authentication of administrators.

  • CVE-2016-1171MedApr 6, 2016
    Basercms
    Basercms
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the Recruit plugin before 0.9.3 for baserCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2016-1170HigApr 6, 2016
    Basercms
    Casebook
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Casebook plugin before 0.9.4 for baserCMS allows remote attackers to hijack the authentication of administrators.

  • CVE-2016-1169MedApr 6, 2016
    Hiniarata
    Casebook Plugin
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the Casebook plugin before 0.9.4 for baserCMS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2016-0871HigApr 6, 2016
    Eaton
    Eg2 Web Control
    risk 0.49cvss 7.5epss 0.02

    Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request.

  • CVE-2015-7921CriApr 6, 2016
    Pro Face
    GP-Pro EX EX-ED
    risk 0.59cvss 9.1epss 0.02

    The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these…

  • CVE-2015-6313HigApr 6, 2016
    Cisco Systems, Inc.
    Mobility Services Engine
    risk 0.49cvss 7.5epss 0.03

    Cisco TelePresence Server 4.1(2.29) through 4.2(4.17) on 7010; Mobility Services Engine (MSE) 8710; Multiparty Media 310, 320, and 820; and Virtual Machine (VM) devices allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted HTTP…

  • CVE-2015-6312HigApr 6, 2016
    Cisco Systems, Inc.
    Mobility Services Engine
    risk 0.49cvss 7.5epss 0.02

    Cisco TelePresence Server 3.1 on 7010, Mobility Services Engine (MSE) 8710, Multiparty Media 310 and 320, and Virtual Machine (VM) devices allows remote attackers to cause a denial of service (device reload) via malformed STUN packets, aka Bug ID CSCuv01348.

  • CVE-2016-3969MedApr 6, 2016
    McAfee
    Email Gateway
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in McAfee Email Gateway (MEG) 7.6.x before 7.6.404, when File Filtering is enabled with the action set to ESERVICES:REPLACE, allows remote attackers to inject arbitrary web script or HTML via an attachment in a blocked email.

  • CVE-2016-3968MedApr 6, 2016
    Sophos
    Cyberoam Firmware
    risk 0.40cvss 6.1epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Sophos Cyberoam CR100iNG UTM appliance with firmware 10.6.3 MR-1 build 503, CR35iNG UTM appliance with firmware 10.6.2 MR-1 build 383, and CR35iNG UTM appliance with firmware 10.6.2 Build 378 allow remote attackers to inject…

  • CVE-2016-3118MedApr 6, 2016
    Ca
    API Gateway
    risk 0.42cvss 6.5epss 0.01

    CRLF injection vulnerability in CA API Gateway (formerly Layer7 API Gateway) 7.1 before 7.1.04, 8.0 through 8.3 before 8.3.01, and 8.4 before 8.4.01 allows remote attackers to have an unspecified impact via unknown vectors.

  • CVE-2016-3125HigApr 5, 2016
    Proftpd
    Proftpd
    risk 0.49cvss 7.5epss 0.07

    The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown…

  • CVE-2016-2000CriApr 5, 2016
    HPE
    Asset Manager
    risk 0.64cvss 9.8epss 0.04

    HPE Asset Manager 9.40, 9.41, and 9.50 and Asset Manager CloudSystem Chargeback 9.40 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

  • CVE-2016-1177MedApr 5, 2016
    Falconsc
    Wisepoint
    risk 0.40cvss 6.1epss 0.01

    The management screen in Falcon WisePoint 4.3.1 and earlier and WisePoint Authenticator 4.1.19.22 and earlier allows remote attackers to conduct clickjacking attacks via unspecified vectors.

  • CVE-2016-1789MedApr 5, 2016
    Apple Inc.
    Ibooks Author
    risk 0.36cvss 5.5epss 0.01

    Apple iBooks Author before 2.4.1 allows remote attackers to read arbitrary files via an iBooks Author file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

  • CVE-2016-1176MedApr 5, 2016
    Sharp
    EVA Animeter
    risk 0.41cvss 6.3epss 0.01

    Buffer overflow in the ActiveX control in Sharp EVA Animeter allows remote attackers to execute arbitrary code via a crafted web page.

  • CVE-2016-1175MedApr 5, 2016
    Sharp
    AQUOS Photo Player HN-PP150
    risk 0.28cvss 4.3epss 0.01

    Cross-site request forgery (CSRF) vulnerability in AQUOS Photo Player HN-PP150 1.02.00.04 through 1.03.01.04 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2016-0289MedApr 5, 2016
    IBM
    Maximo Asset Management
    risk 0.28cvss 4.3epss 0.01

    shiprec.xml in the SHIPREC application in IBM Maximo Asset Management 7.1 and 7.5 before 7.5.0.10 and 7.6 before 7.6.0.4 allows remote authenticated users to bypass intended item-selection restrictions via unspecified vectors.

  • CVE-2015-8523HigApr 5, 2016
    IBM
    Tivoli Storage Manager Fastback
    risk 0.49cvss 7.5epss 0.01

    The server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to cause a denial of service (service crash) via crafted packets to a TCP port.

  • CVE-2015-8522CriApr 5, 2016
    IBM
    Tivoli Storage Manager Fastback
    risk 0.64cvss 9.8epss 0.03

    Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8520, and CVE-2015-8521.

  • CVE-2015-8521CriApr 5, 2016
    IBM
    Tivoli Storage Manager Fastback
    risk 0.64cvss 9.8epss 0.03

    Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8520, and CVE-2015-8522.

  • CVE-2015-8520CriApr 5, 2016
    IBM
    Tivoli Storage Manager Fastback
    risk 0.64cvss 9.8epss 0.03

    Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8521, and CVE-2015-8522.

  • CVE-2015-8519CriApr 5, 2016
    IBM
    Tivoli Storage Manager Fastback
    risk 0.64cvss 9.8epss 0.03

    Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8520, CVE-2015-8521, and CVE-2015-8522.

  • CVE-2016-2343CriApr 1, 2016
    Patterson Dental
    Eaglesoft
    risk 0.64cvss 9.8epss 0.02

    Patterson Dental Eaglesoft 17 has a hardcoded password of sql for the dba account, which allows remote attackers to obtain sensitive Dental.DB patient information via SQL statements.

  • CVE-2016-2289HigApr 1, 2016
    Iconics
    Webhmi
    risk 0.49cvss 7.5epss 0.02

    Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashes, via unspecified vectors.

  • CVE-2016-0793HigApr 1, 2016
    Red Hat
    Jboss Wildfly Application Server
    risk 0.53cvss 7.5epss 0.15

    Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that…

  • CVE-2016-1168HigApr 1, 2016
    NEC
    Aterm WF800HP
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability on NEC Aterm WF800HP devices with firmware 1.0.17 and earlier allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2016-1167HigApr 1, 2016
    NEC
    Aterm WG300HP
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability on NEC Aterm WG300HP devices allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2016-1345HigApr 1, 2016
    Cisco Systems, Inc.
    Firesight System Software
    risk 0.49cvss 7.5epss 0.01

    Cisco FireSIGHT System Software 5.4.0 through 6.0.1 and ASA with FirePOWER Services 5.4.0 through 6.0.0.1 allow remote attackers to bypass malware protection via crafted fields in HTTP headers, aka Bug ID CSCux22726.

  • CVE-2016-3142HigMar 31, 2016
    PHP
    PHP
    risk 0.54cvss 8.2epss 0.05

    The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\x05\x06…

  • CVE-2016-3141CriMar 31, 2016
    PHP
    PHP
    risk 0.67cvss 9.8epss 0.36

    Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize…

  • CVE-2015-8837HigMar 30, 2016
    Fuseiso Project
    Fuseiso
    risk 0.48cvss 7.3epss 0.03

    Stack-based buffer overflow in the isofs_real_readdir function in isofs.c in FuseISO 20070708 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long pathname in an ISO file.

  • CVE-2015-8836HigMar 30, 2016
    Fuseiso Project
    Fuseiso
    risk 0.48cvss 7.3epss 0.02

    Integer overflow in the isofs_real_read_zf function in isofs.c in FuseISO 20070708 might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ZF block size in an ISO file, leading to a heap-based buffer…

  • CVE-2016-2288HigMar 29, 2016
    Cogentdatahub
    DataHub
    risk 0.54cvss 7.8epss 0.01

    Cogent DataHub before 7.3.10 allows local users to gain privileges by leveraging the user or guest role to modify a file.

  • CVE-2016-1760MedMar 29, 2016
    Apple Inc.
    iOS
    risk 0.40cvss 6.2epss 0.00

    The XPC Services API in LaunchServices in Apple iOS before 9.3 allows attackers to bypass intended event-handler restrictions and modify an arbitrary app's events via a crafted app.

  • CVE-2016-3679HigMar 29, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    Multiple unspecified vulnerabilities in Google V8 before 4.9.385.33, as used in Google Chrome before 49.0.2623.108, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

  • CVE-2016-1650HigMar 29, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    The PageCaptureSaveAsMHTMLFunction::ReturnFailure function in browser/extensions/api/page_capture/page_capture_api.cc in Google Chrome before 49.0.2623.108 allows attackers to cause a denial of service or possibly have unspecified other impact by triggering an error in creating…

  • CVE-2016-1649HigMar 29, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.03

    The Program::getUniformInternal function in Program.cpp in libANGLE, as used in Google Chrome before 49.0.2623.108, does not properly handle a certain data-type mismatch, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified…

  • CVE-2016-1648HigMar 29, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.02

    Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes_extension_bindings.cc in the Extensions implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted…

  • CVE-2016-1647HigMar 29, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.02

    Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in content/browser/renderer_host/render_widget_host_impl.cc in the Navigation implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have…

  • CVE-2016-1646HigKEVMar 29, 2016
    Google
    Chrome
    risk 0.73cvss 8.8epss 0.48

    The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other…