VYPR

CVEs

397,970 total · page 6474 of 7,960

AllCriticalHighKEV
  • CVE-2016-0067HigFeb 10, 2016
    Microsoft
    Internet Explorer
    risk 0.58cvss 8.8epss 0.14

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0060,…

  • CVE-2016-0064HigFeb 10, 2016
    Microsoft
    Internet Explorer
    risk 0.58cvss 8.8epss 0.14

    Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

  • CVE-2016-0063HigFeb 10, 2016
    Microsoft
    Internet Explorer
    risk 0.63cvss 8.8epss 0.39

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0060,…

  • CVE-2016-0062HigFeb 10, 2016
    Microsoft
    Internet Explorer
    risk 0.59cvss 8.8epss 0.21

    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."

  • CVE-2016-0061HigFeb 10, 2016
    Microsoft
    Internet Explorer
    risk 0.59cvss 8.8epss 0.21

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than…

  • CVE-2016-0060HigFeb 10, 2016
    Microsoft
    Internet Explorer
    risk 0.59cvss 8.8epss 0.27

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than…

  • CVE-2016-0059MedFeb 10, 2016
    Microsoft
    Internet Explorer
    risk 0.30cvss 4.3epss 0.23

    The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted URL in a (1) e-mail message or (2) Office document, aka "Internet Explorer Information Disclosure Vulnerability."

  • CVE-2016-0058HigFeb 10, 2016
    Microsoft
    Windows Server 2012
    risk 0.53cvss 7.8epss 0.23

    Buffer overflow in the PDF Library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code via a crafted PDF document that triggers API calls, aka "Microsoft PDF Library Buffer Overflow Vulnerability."

  • CVE-2016-0056HigFeb 10, 2016
    Microsoft
    Word
    risk 0.52cvss 7.8epss 0.16

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-0055HigFeb 10, 2016
    Microsoft
    Office
    risk 0.52cvss 7.8epss 0.16

    Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-0054HigFeb 10, 2016
    Microsoft
    Excel
    risk 0.52cvss 7.8epss 0.16

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint Server 2010 SP2, Excel…

  • CVE-2016-0053HigFeb 10, 2016
    Microsoft
    Word
    risk 0.52cvss 7.8epss 0.19

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps Server 2013 SP1, and SharePoint Server 2013 SP1 allow remote…

  • CVE-2016-0052HigFeb 10, 2016
    Microsoft
    Word
    risk 0.52cvss 7.8epss 0.19

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps Server 2013 SP1, and…

  • CVE-2016-0051HigFeb 10, 2016
    Microsoft
    Windows
    risk 0.56cvss 7.8epss 0.23

    The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "WebDAV Elevation…

  • CVE-2016-0050MedFeb 10, 2016
    Microsoft
    Windows Server 2008
    risk 0.36cvss 5.3epss 0.18

    Network Policy Server (NPS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 misparses username queries, which allows remote attackers to cause a denial of service (RADIUS authentication outage) via crafted requests, aka "Network Policy Server RADIUS…

  • CVE-2016-0049MedFeb 10, 2016
    Microsoft
    Windows
    risk 0.44cvss 6.2epss 0.13

    Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 does not properly validate password changes, which allows remote attackers to bypass authentication by deploying…

  • CVE-2016-0048HigFeb 10, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.02

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k…

  • CVE-2016-0047HigFeb 10, 2016
    Microsoft
    .net Framework
    risk 0.50cvss 7.5epss 0.20

    WinForms in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to obtain sensitive information from process memory via crafted icon data, aka "Windows Forms Information Disclosure Vulnerability."

  • CVE-2016-0046HigFeb 10, 2016
    Microsoft
    Windows Server 2012
    risk 0.53cvss 7.8epss 0.26

    Windows Reader in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code via a crafted Reader file, aka "Microsoft Windows Reader Vulnerability."

  • CVE-2016-0044HigFeb 10, 2016
    Microsoft
    Windows Server 2012
    risk 0.50cvss 7.5epss 0.14

    Sync Framework in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows remote attackers to cause a denial of service (SyncShareSvc service outage) via crafted "change batch" data, aka "Windows DLL Loading Denial of Service Vulnerability."

  • CVE-2016-0042HigFeb 10, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.06

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "Windows…

  • CVE-2016-0041HigFeb 10, 2016
    Microsoft
    Internet Explorer
    risk 0.60cvss 7.8epss 0.83

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11 mishandle DLL loading, which allows local users to gain privileges via a…

  • CVE-2016-0040HigKEVFeb 10, 2016
    Microsoft
    Windows
    risk 0.68cvss 7.8epss 0.24

    The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."

  • CVE-2016-0039MedFeb 10, 2016
    Microsoft
    Sharepoint Foundation
    risk 0.40cvss 6.1epss 0.06

    Cross-site scripting (XSS) vulnerability in SharePoint Server in Microsoft SharePoint Foundation 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."

  • CVE-2016-0038HigFeb 10, 2016
    Microsoft
    Windows
    risk 0.52cvss 7.8epss 0.20

    Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Memory…

  • CVE-2016-0037HigFeb 10, 2016
    Microsoft
    Windows Server 2012
    risk 0.51cvss 7.5epss 0.26

    The forms-based authentication implementation in Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2 allows remote attackers to cause a denial of service (daemon outage) via crafted data, aka "Microsoft Active Directory Federation Services Denial…

  • CVE-2016-0036HigFeb 10, 2016
    Microsoft
    Windows 7
    risk 0.54cvss 8.1epss 0.11

    The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote authenticated users to execute arbitrary code via crafted data, aka "Remote Desktop Protocol (RDP) Elevation of Privilege…

  • CVE-2016-0033HigFeb 10, 2016
    Microsoft
    .net Framework
    risk 0.50cvss 7.5epss 0.18

    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, which allows remote attackers to cause a denial of service (performance degradation) via crafted XSLT data, aka ".NET Framework Stack Overflow Denial of…

  • CVE-2016-0022HigFeb 10, 2016
    Microsoft
    Word
    risk 0.52cvss 7.8epss 0.19

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps Server 2013 SP1, and…

  • CVE-2016-1319MedFeb 9, 2016
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.35cvss 5.3epss 0.01

    Cisco Unified Communications Manager (aka CallManager) 9.1(2.10000.28), 10.5(2.10000.5), 10.5(2.12901.1), and 11.0(1.10000.10); Unified Communications Manager IM & Presence Service 10.5(2); Unified Contact Center Express 11.0(1); and Unity Connection 10.5(2) store a cleartext…

  • CVE-2016-1318MedFeb 9, 2016
    Cisco Systems, Inc.
    Application Policy Infrastructure Controller Enterprise Module
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.1 allows remote attackers to inject arbitrary web script or HTML via crafted markup data, aka Bug ID CSCux15489.

  • CVE-2016-1317MedFeb 9, 2016
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.28cvss 4.3epss 0.01

    Cisco Unified Communications Manager 11.5(0.98000.480) allows remote authenticated users to obtain sensitive database table-name and entity-name information via a direct request to an unspecified URL, aka Bug ID CSCuy11098.

  • CVE-2016-1316MedFeb 9, 2016
    Cisco Systems, Inc.
    Telepresence Video Communication Server
    risk 0.35cvss 5.3epss 0.01

    Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7, as used in conjunction with Jabber Guest, allows remote attackers to obtain sensitive call-statistics information via a direct request to an unspecified URL, aka Bug ID CSCux73362.

  • CVE-2016-2268MedFeb 8, 2016
    Dell
    Secureworks
    risk 0.44cvss 6.8epss 0.01

    Dell SecureWorks app before 2.1 for iOS does not validate SSL certificates, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2016-2214MedFeb 8, 2016
    Huawei
    Agile Controller Campus
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in an unspecified portal authentication page in Huawei Agile Controller-Campus with software before V100R001C00SPC319 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

  • CVE-2016-2091LowFeb 8, 2016
    Libdwarf Project
    Libdwarf
    risk 0.22cvss 3.3epss 0.01

    The dwarf_read_cie_fde_prefix function in dwarf_frame2.c in libdwarf 20151114 allows attackers to cause a denial of service (out-of-bounds read) via a crafted ELF object file.

  • CVE-2016-2089MedFeb 8, 2016
    Jasper
    JasPer
    risk 0.42cvss 6.5epss 0.03

    The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image.

  • CVE-2016-2048MedFeb 8, 2016
    Djangoproject
    Django
    risk 0.29cvss 5.5epss 0.02

    Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.

  • CVE-2015-8361CriFeb 8, 2016
    Atlassian
    Bamboo
    risk 0.59cvss 9.1epss 0.03

    Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain sensitive information, modify settings, or manage build agents via unknown vectors involving the JMS port.

  • CVE-2015-8360CriFeb 8, 2016
    Atlassian
    Bamboo
    risk 0.64cvss 9.8epss 0.03

    An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port.

  • CVE-2015-3252CriFeb 8, 2016
    Apache
    Cloudstack
    risk 0.57cvss 9.8epss 0.02

    Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server.

  • CVE-2015-3251MedFeb 8, 2016
    Apache
    Cloudstack
    risk 0.25cvss 4.9epss 0.02

    Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of virtual machines via unspecified vectors related to API calls.

  • CVE-2014-9757CriFeb 8, 2016
    Atlassian
    Bamboo
    risk 0.64cvss 9.8epss 0.02

    The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via serialized data in an XMPP message.

  • CVE-2016-2230CriFeb 8, 2016
    Openelec
    Openelec
    risk 0.64cvss 9.8epss 0.04

    OpenELEC and RasPlex devices have a hardcoded password for the root account, which makes it easier for remote attackers to obtain access via an SSH session.

  • CVE-2016-2201MedFeb 8, 2016
    Siemens Foundation
    Simatic S7 1500 CPU Firmware
    risk 0.35cvss 5.3epss 0.03

    Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to bypass a replay protection mechanism via packets on TCP port 102.

  • CVE-2016-2200HigFeb 8, 2016
    Siemens Foundation
    Simatic S7 1500 CPU Firmware
    risk 0.49cvss 7.5epss 0.06

    Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to cause a denial of service (STOP mode transition) via crafted packets on TCP port 102.

  • CVE-2016-0603Feb 8, 2016
    Oracle Corporation
    Java Se
    risk 0.00cvss —epss 0.04

    Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. NOTE: the previous information is…

  • CVE-2015-2012MedFeb 8, 2016
    IBM
    Websphere Mq
    risk 0.26cvss 4.0epss 0.00

    The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cleartext file containing the SSL keystore password, which allows local users to obtain sensitive information by reading…

  • CVE-2016-0728HigFeb 8, 2016
    Linux
    Kernel
    risk 0.47cvss 7.8epss 0.03

    The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted…

  • CVE-2016-0723MedFeb 8, 2016
    Linux
    Kernel
    risk 0.37cvss 6.8epss 0.00

    Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during…