VYPR

CVEs

397,972 total · page 6471 of 7,960

AllCriticalHighKEV
  • CVE-2016-0795HigFeb 18, 2016
    Libreoffice
    Libreoffice
    risk 0.51cvss 7.8epss 0.03

    LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document.

  • CVE-2016-0794HigFeb 18, 2016
    Libreoffice
    Libreoffice
    risk 0.51cvss 7.8epss 0.03

    The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document.

  • CVE-2015-7547HigFeb 18, 2016
    GNU
    Glibc
    risk 0.63cvss 8.1epss 0.91

    Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS…

  • CVE-2015-8287MedFeb 18, 2016
    Swannsecurity
    SRNVW-470LCD
    risk 0.35cvss 5.3epss 0.01

    Swann SRNVW-470LCD devices with firmware through 0114 and SWNVW-470CAM devices with firmware through 1022 allow remote attackers to watch live video by visiting an unspecified URL.

  • CVE-2015-8286CriFeb 18, 2016
    Zhuhai RaySharp
    RaySharp firmware
    risk 0.64cvss 9.8epss 0.05

    Zhuhai RaySharp firmware has a hardcoded root password, which makes it easier for remote attackers to obtain access via a session on TCP port 23 or 9000.

  • CVE-2016-2398MedFeb 17, 2016
    Comcast
    Xfinity Home Security System
    risk 0.42cvss 6.5epss 0.01

    Comcast XFINITY Home Security System does not properly maintain base-station communication, which allows physically proximate attackers to defeat sensor functionality by interfering with ZigBee 2.4 GHz transmissions.

  • CVE-2016-1334MedFeb 17, 2016
    Cisco Systems, Inc.
    Small Business 100 Series Wireless Access Points
    risk 0.35cvss 5.3epss 0.01

    Cisco Small Business 500 Wireless Access Point devices with firmware 1.0.4.4 allow remote attackers to set the system time via a crafted POST request, aka Bug ID CSCuy01457.

  • CVE-2016-1333MedFeb 17, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.42cvss 6.5epss 0.02

    Cisco IOS 15.5(3)M and 15.6(1)T0a on Cisco 1000 Connected Grid routers allows remote authenticated users to cause a denial of service (device reload) via an SNMP request for unspecified BRIDGE MIB OIDs, aka Bug ID CSCux89878.

  • CVE-2016-2397CriFeb 17, 2016
    SonicWall
    Analyzer
    risk 0.64cvss 9.8epss 0.06

    The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data.

  • CVE-2016-2396CriFeb 17, 2016
    SonicWall
    Analyzer
    risk 0.65cvss 9.9epss 0.05

    The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via vectors related to configuration input.

  • CVE-2016-2072MedFeb 17, 2016
    Citrix Systems
    Netscaler
    risk 0.40cvss 6.1epss 0.01

    The Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, 10.5.e before Build 59.1305.e, and 10.1 allows remote attackers to conduct clickjacking attacks via…

  • CVE-2016-2071CriFeb 17, 2016
    Citrix Systems
    Netscaler
    risk 0.64cvss 9.8epss 0.03

    Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, and 10.5.e before Build 59.1305.e allows remote attackers to gain privileges via unspecified NS Web GUI commands.

  • CVE-2016-2046MedFeb 17, 2016
    Sophos
    Unified Threat Management Software
    risk 0.40cvss 6.1epss 0.03

    Cross-site scripting (XSS) vulnerability in the UserPortal page in SOPHOS UTM before 9.353 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

  • CVE-2016-0773HigFeb 17, 2016
    PostgreSQL
    PostgreSQL
    risk 0.49cvss 7.5epss 0.07

    PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 allows remote attackers to cause a denial of service (infinite loop or buffer overflow and crash) via a large Unicode character range in a regular expression.

  • CVE-2016-0766HigFeb 17, 2016
    PostgreSQL
    PostgreSQL
    risk 0.58cvss 8.8epss 0.04

    PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.

  • CVE-2013-7447MedFeb 17, 2016
    Gtk
    Gtk\+
    risk 0.43cvss 6.5epss 0.05

    Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9.8, as used in eom, gnome-photos, eog, gambas3, thunar, pinpoint, and possibly other applications, allows remote attackers to cause a denial of service (crash) via a large image…

  • CVE-2016-1153MedFeb 17, 2016
    Cybozu
    Office
    risk 0.42cvss 6.5epss 0.02

    customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service via unspecified vectors, a different vulnerability than CVE-2015-8489.

  • CVE-2016-1152MedFeb 17, 2016
    Cybozu
    Office
    risk 0.35cvss 5.4epss 0.01

    Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions, and read or write to plan data, via unspecified vectors, a different vulnerability than CVE-2015-8484, CVE-2015-8485, and CVE-2015-8486.

  • CVE-2016-1151HigFeb 17, 2016
    Cybozu
    Office
    risk 0.57cvss 8.8epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Cybozu Office 9.9.0 through 10.3.0 allow remote attackers to hijack the authentication of arbitrary users.

  • CVE-2016-1150MedFeb 17, 2016
    Cybozu
    Office
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, and CVE-2016-1149.

  • CVE-2016-1149MedFeb 17, 2016
    Cybozu
    Office
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, and CVE-2016-1150.

  • CVE-2015-8489MedFeb 17, 2016
    Cybozu
    Office
    risk 0.42cvss 6.5epss 0.02

    customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service (excessive database locking) via a crafted CSV file, a different vulnerability than CVE-2016-1153.

  • CVE-2015-8488MedFeb 17, 2016
    Cybozu
    Office
    risk 0.28cvss 4.3epss 0.01

    Cybozu Office 10.3.0 allows remote attackers to read image files via a crafted e-mail message, a different vulnerability than CVE-2015-8487.

  • CVE-2015-8487MedFeb 17, 2016
    Cybozu
    Office
    risk 0.28cvss 4.3epss 0.01

    Cybozu Office 9.0.0 through 10.3 allows remote attackers to discover CSRF tokens via unspecified vectors, a different vulnerability than CVE-2015-8488.

  • CVE-2015-8486MedFeb 17, 2016
    Cybozu
    Office
    risk 0.35cvss 5.4epss 0.01

    Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read arbitrary report titles via unspecified vectors, a different vulnerability than CVE-2015-8484, CVE-2015-8485, and CVE-2016-1152.

  • CVE-2015-8485MedFeb 17, 2016
    Cybozu
    Office
    risk 0.35cvss 5.4epss 0.01

    Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read arbitrary posting titles via unspecified vectors, a different vulnerability than CVE-2015-8484, CVE-2015-8486, and CVE-2016-1152.

  • CVE-2015-8484MedFeb 17, 2016
    Cybozu
    Office
    risk 0.35cvss 5.4epss 0.01

    Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar-viewing restrictions via unspecified vectors, a different vulnerability than CVE-2015-8485, CVE-2015-8486, and CVE-2016-1152.

  • CVE-2015-8483HigFeb 17, 2016
    Cybozu
    Office
    risk 0.48cvss 7.4epss 0.01

    Open redirect vulnerability in Cybozu Office 10.2.0 through 10.3.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.

  • CVE-2015-7798MedFeb 17, 2016
    Cybozu
    Office
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2016-1149, and CVE-2016-1150.

  • CVE-2015-7797MedFeb 17, 2016
    Cybozu
    Office
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.

  • CVE-2015-7796MedFeb 17, 2016
    Cybozu
    Office
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7797, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.

  • CVE-2015-7795MedFeb 17, 2016
    Cybozu
    Office
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.

  • CVE-2016-2389HigFeb 16, 2016
    SAP
    Netweaver
    risk 0.55cvss 7.5epss 0.41

    Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security…

  • CVE-2016-2388MedKEVFeb 16, 2016
    SAP
    Netweaver As Java
    risk 0.54cvss 5.3epss 0.52

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

  • CVE-2016-2387MedFeb 16, 2016
    SAP
    Netweaver
    risk 0.40cvss 6.1epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) ns or (2) interface parameter to ProxyServer/register, aka SAP Security Note 2220571.

  • CVE-2016-2386CriKEVFeb 16, 2016
    SAP
    Netweaver J2ee Engine
    risk 0.84cvss 9.8epss 0.72

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

  • CVE-2016-0753MedFeb 16, 2016
    Rubyonrails
    Rails
    risk 0.35cvss 5.3epss 0.07

    Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

  • CVE-2016-0752HigKEVFeb 16, 2016
    Rubyonrails
    Rails
    risk 0.64cvss 7.5epss 0.96

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render…

  • CVE-2016-0751HigFeb 16, 2016
    Rubyonrails
    Rails
    risk 0.43cvss 7.5epss 0.10

    actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a…

  • CVE-2015-7581HigFeb 16, 2016
    Rubyonrails
    Rails
    risk 0.49cvss 7.5epss 0.07

    actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard…

  • CVE-2015-7580MedFeb 16, 2016
    Rubyonrails
    HTML Sanitizer
    risk 0.33cvss 6.1epss 0.02

    Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.

  • CVE-2015-7579MedFeb 16, 2016
    Rubyonrails
    HTML Sanitizer
    risk 0.33cvss 6.1epss 0.03

    Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.

  • CVE-2015-7578MedFeb 16, 2016
    Rubyonrails
    HTML Sanitizer
    risk 0.33cvss 6.1epss 0.02

    Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.

  • CVE-2015-7577MedFeb 16, 2016
    Rubyonrails
    Rails
    risk 0.35cvss 5.3epss 0.04

    activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote…

  • CVE-2015-7576LowFeb 16, 2016
    Rubyonrails
    Rails
    risk 0.17cvss 3.7epss 0.05

    The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before…

  • CVE-2016-1331MedFeb 15, 2016
    Cisco Systems, Inc.
    Emergency Responder
    risk 0.40cvss 6.1epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 11.5(0.99833.5) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuy10766.

  • CVE-2016-1330MedFeb 15, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.42cvss 6.5epss 0.01

    Cisco IOS 15.2(4)E on Industrial Ethernet 2000 devices allows remote attackers to cause a denial of service (device reload) via crafted Cisco Discovery Protocol (CDP) packets, aka Bug ID CSCuy27746.

  • CVE-2016-1321MedFeb 15, 2016
    Cisco Systems, Inc.
    Universal Small Cell
    risk 0.38cvss 5.8epss 0.01

    Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, which allows remote attackers to bypass a certain certificate-validation feature and obtain sensitive firmware-image and IP address data via a request to an…

  • CVE-2016-0232MedFeb 15, 2016
    IBM
    Financial Transaction Manager
    risk 0.28cvss 4.3epss 0.01

    IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by reading README files.

  • CVE-2016-0231MedFeb 15, 2016
    IBM
    Financial Transaction Manager
    risk 0.28cvss 4.3epss 0.01

    IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by reading exception details in error logs.