VYPR

CVEs

397,972 total · page 6472 of 7,960

AllCriticalHighKEV
  • CVE-2016-0747MedFeb 15, 2016
    Nginx
    Nginx
    risk 0.35cvss 5.3epss 0.09

    The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.

  • CVE-2016-0746CriFeb 15, 2016
    Nginx
    Nginx
    risk 0.64cvss 9.8epss 0.09

    Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response…

  • CVE-2016-0742HigFeb 15, 2016
    Nginx
    Nginx
    risk 0.55cvss 7.5epss 0.82

    The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.

  • CVE-2016-2314MedFeb 15, 2016
    Huawei
    SmartAX MT882
    risk 0.32cvss 4.9epss 0.01

    GlobespanVirata ftpd 1.0, as used on Huawei SmartAX MT882 devices V200R002B022 Arg, allows remote authenticated users to cause a denial of service (device outage) by using the FTP MKD command to create a directory with a long name, and then using certain other commands.

  • CVE-2016-2231CriFeb 15, 2016
    Huawei
    SmartAX MT882
    risk 0.64cvss 9.8epss 0.01

    The Windows-based Host Interface Program (WHIP) service on Huawei SmartAX MT882 devices V200R002B022 Arg relies on the client to send a length field that is consistent with a buffer size, which allows remote attackers to cause a denial of service (device outage) or possibly have…

  • CVE-2016-0701LowFeb 15, 2016
    OpenSSL Project
    OpenSSL
    risk 0.31cvss 3.7epss 0.84

    The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple…

  • CVE-2015-8797MedFeb 15, 2016
    Apache
    Solr
    risk 0.40cvss 6.1epss 0.03

    Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.

  • CVE-2015-8796MedFeb 15, 2016
    Apache
    Solr
    risk 0.33cvss 6.1epss 0.03

    Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr before 5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted schema-browse URL.

  • CVE-2015-8795MedFeb 15, 2016
    Apache
    Solr
    risk 0.40cvss 6.1epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to…

  • CVE-2015-8531MedFeb 15, 2016
    IBM
    Security Access Manager For Web 8.0 Firmware
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Web 8.0 before 8.0.1.3 IF4 and 9.0 before 9.0.0.1 IF1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2015-7492MedFeb 15, 2016
    IBM
    Infosphere Master Data Management
    risk 0.35cvss 5.4epss 0.01

    Cross-site scripting (XSS) vulnerability in Reference Data Management (RDM) in IBM InfoSphere Master Data Management 10.1, 11.0 before FP5, 11.3, 11.4, and 11.5 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2015-7472HigFeb 15, 2016
    IBM
    Websphere Portal
    risk 0.47cvss 7.2epss 0.02

    IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF20, and 8.5.0 before CF10 allows remote attackers to conduct LDAP injection attacks, and consequently read or write to repository data, via unspecified…

  • CVE-2015-7444MedFeb 15, 2016
    IBM
    Websphere Commerce
    risk 0.35cvss 5.3epss 0.01

    The Update Installer in IBM WebSphere Commerce Enterprise 7.0.0.8 and 7.0.0.9 does not properly replicate the search index, which allows attackers to obtain sensitive information via unspecified vectors.

  • CVE-2015-7408LowFeb 15, 2016
    IBM
    Tivoli Storage Manager
    risk 0.24cvss 3.7epss 0.01

    The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority.

  • CVE-2015-7398MedFeb 15, 2016
    IBM
    Emptoris Contract Management
    risk 0.35cvss 5.4epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to inject arbitrary web…

  • CVE-2015-5050HigFeb 15, 2016
    IBM
    Emptoris Contract Management
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to hijack the…

  • CVE-2015-5042HigFeb 15, 2016
    IBM
    Emptoris Contract Management
    risk 0.49cvss 7.5epss 0.02

    IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote attackers to execute arbitrary code by including a crafted Flash file.

  • CVE-2015-5012HigFeb 15, 2016
    IBM
    Security Access Manager For Web 8.0 Firmware
    risk 0.49cvss 7.5epss 0.02

    The SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the set of MAC algorithms, which makes it easier for remote attackers to defeat cryptographic protection…

  • CVE-2015-5010HigFeb 15, 2016
    IBM
    Security Access Manager For Web 8.0 Firmware
    risk 0.49cvss 7.5epss 0.02

    IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.

  • CVE-2015-4991MedFeb 15, 2016
    IBM
    Spss Modeler
    risk 0.26cvss 4.0epss 0.00

    IBM SPSS Modeler 14.2 through FP3 IF027, 15 through FP3 IF015, 16 through FP2 IF012, 17 through FP1 IF018, and 17.1 through IF008 includes unspecified cleartext data in memory dumps, which allows local users to obtain sensitive information by reading a dump file.

  • CVE-2015-4957MedFeb 15, 2016
    IBM
    QRadar SIEM
    risk 0.35cvss 5.4epss 0.01

    Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2015-4956HigFeb 15, 2016
    IBM
    QRadar SIEM
    risk 0.48cvss 7.4epss 0.01

    The Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to execute unspecified OS commands via unknown vectors.

  • CVE-2015-3197MedFeb 15, 2016
    OpenSSL Project
    OpenSSL
    risk 0.39cvss 5.9epss 0.11

    ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the…

  • CVE-2015-2008MedFeb 15, 2016
    IBM
    QRadar SIEM
    risk 0.29cvss 4.4epss 0.01

    IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.6 includes SSH private keys during backup operations, which allows remote authenticated administrators to obtain sensitive information by reading a backup archive.

  • CVE-2015-2005MedFeb 15, 2016
    IBM
    QRadar SIEM
    risk 0.35cvss 5.3epss 0.01

    IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.

  • CVE-2016-1627HigFeb 14, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    The Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access…

  • CVE-2016-1626MedFeb 14, 2016
    Google
    Chrome
    risk 0.28cvss 4.3epss 0.01

    The opj_pi_update_decode_poc function in pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, miscalculates a certain layer index value, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.

  • CVE-2016-1625MedFeb 14, 2016
    Google
    Chrome
    risk 0.28cvss 4.3epss 0.01

    The Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab Page (NTP) navigation target is on the most-visited or suggestions list, which allows remote attackers to bypass intended restrictions via unspecified vectors, related to…

  • CVE-2016-1624HigFeb 14, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    Integer underflow in the ProcessCommandsInternal function in dec/decode.c in Brotli, as used in Google Chrome before 48.0.2564.109, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli…

  • CVE-2016-1623HigFeb 14, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    The DOM implementation in Google Chrome before 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to…

  • CVE-2016-1622HigFeb 14, 2016
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    The Extensions subsystem in Google Chrome before 48.0.2564.109 does not prevent use of the Object.defineProperty method to override intended extension behavior, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.

  • CVE-2016-1949HigFeb 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.57cvss 8.8epss 0.01

    Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a…

  • CVE-2016-1526HigFeb 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.53cvss 8.1epss 0.02

    The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of…

  • CVE-2016-1525HigFeb 13, 2016
    Netgear
    Management System NMS300
    risk 0.65cvss 8.6epss 0.75

    Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. (dot dot) in the realName parameter.

  • CVE-2016-1524CriFeb 13, 2016
    Netgear
    NMS300
    risk 0.73cvss 9.6epss 0.94

    Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via…

  • CVE-2016-1523MedFeb 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.42cvss 6.5epss 0.02

    The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL…

  • CVE-2016-1522HigFeb 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.58cvss 8.8epss 0.08

    Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly…

  • CVE-2016-1521HigFeb 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.58cvss 8.8epss 0.04

    The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive…

  • CVE-2016-0866MedFeb 13, 2016
    Enghousenetworks
    Smartgrid Lighthouse Sensor Management System
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2016-0865HigFeb 13, 2016
    Enghousenetworks
    Smartgrid Lighthouse Sensor Management System
    risk 0.57cvss 8.8epss 0.02

    Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote authenticated users to change arbitrary passwords via unspecified vectors.

  • CVE-2016-0864MedFeb 13, 2016
    Enghousenetworks
    Smartgrid Lighthouse Sensor Management System
    risk 0.35cvss 5.3epss 0.01

    Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to obtain sensitive report and username information via unspecified vectors.

  • CVE-2016-0863HigFeb 13, 2016
    Enghousenetworks
    Smartgrid Lighthouse Sensor Management System
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2015-8631MedFeb 13, 2016
    Mit
    Kerberos 5
    risk 0.36cvss 6.5epss 0.05

    Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.

  • CVE-2015-8630HigFeb 13, 2016
    Mit
    Kerberos 5
    risk 0.42cvss 7.5epss 0.04

    The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer…

  • CVE-2015-8629MedFeb 13, 2016
    Mit
    Kerberos 5
    risk 0.28cvss 5.3epss 0.04

    The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a…

  • CVE-2016-2073MedFeb 12, 2016
    Xmlsoft
    Libxml2
    risk 0.42cvss 6.5epss 0.02

    The htmlParseNameComplex function in HTMLparser.c in libxml2 allows attackers to cause a denial of service (out-of-bounds read) via a crafted XML document.

  • CVE-2016-2330HigFeb 12, 2016
    FFmpeg
    Ffmpeg
    risk 0.57cvss 8.8epss 0.03

    libavcodec/gif.c in FFmpeg before 2.8.6 does not properly calculate a buffer size, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .tga file, related to the gif_image_write_image,…

  • CVE-2016-2329HigFeb 12, 2016
    FFmpeg
    Ffmpeg
    risk 0.57cvss 8.8epss 0.03

    libavcodec/tiff.c in FFmpeg before 2.8.6 does not properly validate RowsPerStrip values and YCbCr chrominance subsampling factors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted TIFF…

  • CVE-2016-2328HigFeb 12, 2016
    FFmpeg
    Ffmpeg
    risk 0.57cvss 8.8epss 0.03

    libswscale/swscale_unscaled.c in FFmpeg before 2.8.6 does not validate certain height values, which allows remote attackers to cause a denial of service (out-of-bounds array read access) or possibly have unspecified other impact via a crafted .cine file, related to the…

  • CVE-2016-2327HigFeb 12, 2016
    FFmpeg
    Ffmpeg
    risk 0.57cvss 8.8epss 0.03

    libavcodec/pngenc.c in FFmpeg before 2.8.5 uses incorrect line sizes in certain row calculations, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted .avi file, related to the…