VYPR

CVEs

397,995 total · page 6464 of 7,960

AllCriticalHighKEV
  • CVE-2016-1752MedMar 24, 2016
    Apple Inc.
    tvOS
    risk 0.36cvss 5.5epss 0.01

    The kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to cause a denial of service via a crafted app.

  • CVE-2016-1751HigMar 24, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.01

    The kernel in Apple iOS before 9.3, tvOS before 9.2, and watchOS before 2.2 does not properly restrict the execute permission, which allows attackers to bypass a code-signing protection mechanism via a crafted app.

  • CVE-2016-1750HigMar 24, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.02

    Use-after-free vulnerability in the kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to execute arbitrary code in a privileged context via a crafted app.

  • CVE-2016-1749HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.54cvss 7.8epss 0.04

    IOUSBFamily in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-1748LowMar 24, 2016
    Apple Inc.
    tvOS
    risk 0.22cvss 3.3epss 0.01

    IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.

  • CVE-2016-1747HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.02

    IOGraphics in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1746.

  • CVE-2016-1746HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.02

    IOGraphics in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1747.

  • CVE-2016-1745MedMar 24, 2016
    Apple Inc.
    OS X
    risk 0.36cvss 5.5epss 0.00

    IOFireWireFamily in Apple OS X before 10.11.4 allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors.

  • CVE-2016-1744HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.54cvss 7.8epss 0.04

    The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1743.

  • CVE-2016-1743HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.54cvss 7.8epss 0.05

    The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1744.

  • CVE-2016-1741CriMar 24, 2016
    Apple Inc.
    OS X
    risk 0.68cvss 9.8epss 0.12

    The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-1740HigMar 24, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.04

    FontParser in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document.

  • CVE-2016-1738HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.00

    dyld in Apple OS X before 10.11.4 allows attackers to bypass a code-signing protection mechanism via a modified app.

  • CVE-2016-1737MedMar 24, 2016
    Apple Inc.
    OS X
    risk 0.41cvss 6.3epss 0.02

    Carbon in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dfont file.

  • CVE-2016-1736HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.01

    Bluetooth in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1735.

  • CVE-2016-1735HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.01

    Bluetooth in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1736.

  • CVE-2016-1734MedMar 24, 2016
    Apple Inc.
    iOS
    risk 0.44cvss 6.8epss 0.01

    AppleUSBNetworking in Apple iOS before 9.3 and OS X before 10.11.4 allows physically proximate attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted USB device.

  • CVE-2016-1733HigMar 24, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.01

    AppleRAID in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-1732MedMar 24, 2016
    Apple Inc.
    OS X
    risk 0.36cvss 5.5epss 0.00

    AppleRAID in Apple OS X before 10.11.4 allows local users to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds read) via unspecified vectors.

  • CVE-2016-1599MedMar 24, 2016
    Microfocus
    Self Service Password Reset
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2015-7551HigMar 24, 2016
    Ruby Lang
    Ruby
    risk 0.48cvss 8.4epss 0.01

    The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or…

  • CVE-2015-6854CriMar 24, 2016
    Ca
    CA Single Sign-On
    risk 0.59cvss 9.1epss 0.01

    The non-Domino web agents in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.

  • CVE-2015-6853CriMar 24, 2016
    Ca
    CA Single Sign-On
    risk 0.59cvss 9.1epss 0.01

    The Domino web agent in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service (daemon crash) or obtain sensitive…

  • CVE-2009-2197MedMar 24, 2016
    Apple Inc.
    Safari
    risk 0.28cvss 4.3epss 0.01

    Apple Safari before 9.1 allows remote attackers to spoof the user interface via a web page that places text in a crafted context, leading to unintended use of that text within a Safari dialog.

  • CVE-2016-3116MedMar 22, 2016
    Dropbear SSH Project
    Dropbear SSH
    risk 0.39cvss 6.4epss 0.19

    CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.

  • CVE-2016-3115MedMar 22, 2016
    OpenBSD
    OpenSSH
    risk 0.40cvss 6.4epss 0.36

    Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

  • CVE-2016-1998CriMar 22, 2016
    HPE
    Service Manager
    risk 0.64cvss 9.8epss 0.07

    HPE Service Manager (SM) 9.3x before 9.35 P4 and 9.4x before 9.41.P2 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

  • CVE-2016-1997CriMar 22, 2016
    HPE
    Operations Orchestration content
    risk 0.64cvss 9.8epss 0.07

    HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

  • CVE-2015-7454MedMar 21, 2016
    IBM
    Websphere Process Server
    risk 0.28cvss 4.3epss 0.01

    Business Space in IBM WebSphere Process Server 6.1.2.0 through 7.0.0.5 and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0.x through 8.5.0.2, 8.5.5.x through 8.5.5.0, and 8.5.6.x through 8.5.6.2 allows remote authenticated users to bypass…

  • CVE-2016-2245CriMar 19, 2016
    Microfocus
    Support Assistant
    risk 0.64cvss 9.8epss 0.06

    HP Support Assistant before 8.1.52.1 allows remote attackers to bypass authentication via unspecified vectors.

  • CVE-2016-0283MedMar 19, 2016
    IBM
    Websphere Application Server
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in the OpenID Connect (OIDC) client web application in IBM WebSphere Application Server (WAS) Liberty Profile 8.5.5 before 8.5.5.9 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2016-2287MedMar 19, 2016
    Xzeres
    442sr OS
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-2286MedMar 19, 2016
    Edx
    Open Edx
    risk 0.35cvss 6.5epss 0.02

    lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this…

  • CVE-2016-3155LowMar 18, 2016
    Siemens Foundation
    Apogee Insight
    risk 0.22cvss 3.4epss 0.00

    Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecified vectors.

  • CVE-2016-2281HigMar 18, 2016
    Abb
    Panel Builder 800
    risk 0.47cvss 7.2epss 0.00

    Untrusted search path vulnerability in ABB Panel Builder 800 5.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory.

  • CVE-2015-8154HigMar 18, 2016
    Symantec
    Endpoint Protection
    risk 0.58cvss 8.8epss 0.05

    The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows remote attackers to execute arbitrary code via a crafted HTML document, related to "RWX Permissions."

  • CVE-2015-8153HigMar 18, 2016
    Symantec
    Endpoint Protection Manager
    risk 0.57cvss 8.8epss 0.03

    SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2015-8152HigMar 18, 2016
    Symantec
    Endpoint Protection Manager
    risk 0.52cvss 8.0epss 0.02

    Cross-site request forgery (CSRF) vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script.

  • CVE-2014-9768HigMar 18, 2016
    IBM
    Tivoli Netview Access Services
    risk 0.57cvss 8.8epss 0.02

    IBM Tivoli NetView Access Services (NVAS) allows remote authenticated users to gain privileges by entering the ADM command and modifying a "page ID" field to the EMSPG2 transaction code. NOTE: the vendor's perspective is that configuration and use of available security controls…

  • CVE-2016-1996HigMar 18, 2016
    HPE
    System Management Homepage
    risk 0.50cvss 7.7epss 0.01

    HPE System Management Homepage before 7.5.4 allows local users to obtain sensitive information or modify data via unspecified vectors.

  • CVE-2016-1995CriMar 18, 2016
    HPE
    System Management Homepage
    risk 0.65cvss 9.8epss 0.10

    HPE System Management Homepage before 7.5.4 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2016-1994MedMar 18, 2016
    HPE
    System Management Homepage
    risk 0.42cvss 6.5epss 0.02

    HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information via unspecified vectors.

  • CVE-2016-1993HigMar 18, 2016
    HPE
    System Management Homepage
    risk 0.53cvss 8.1epss 0.02

    HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors.

  • CVE-2015-5968MedMar 18, 2016
    Novell
    Filr
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Novell Filr 1.2 before Hot Patch 4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2016-3191CriMar 17, 2016
    Pcre
    Pcre
    risk 0.64cvss 9.8epss 0.08

    The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial…

  • CVE-2016-2345CriMar 17, 2016
    SolarWinds
    Dameware Mini Remote Control
    risk 0.71cvss 9.8epss 0.51

    Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code via a crafted string.

  • CVE-2016-2342HigMar 17, 2016
    Quagga (software)
    Quagga
    risk 0.47cvss 8.1epss 0.13

    The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute…

  • CVE-2016-1992MedMar 17, 2016
    HP Enterprise
    ArcSight ESM
    risk 0.42cvss 6.5epss 0.02

    HPE ArcSight ESM before 6.8c, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to obtain sensitive information via unspecified vectors.

  • CVE-2016-2846MedMar 16, 2016
    Siemens Foundation
    SIMATIC S7-1200
    risk 0.42cvss 6.5epss 0.02

    Siemens SIMATIC S7-1200 CPU devices before 4.0 allow remote attackers to bypass a "user program block" protection mechanism via unspecified vectors.

  • CVE-2016-2075MedMar 16, 2016
    VMware
    Vrealize Business Advanced And Enterprise
    risk 0.35cvss 5.4epss 0.01

    Cross-site scripting (XSS) vulnerability in VMware vRealize Business Advanced and Enterprise 8.x before 8.2.5 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.