VYPR

CVEs

396,200 total · page 6485 of 7,924

AllCriticalHighKEV
  • CVE-2015-6601Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22935234.

  • CVE-2015-6600Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22882938.

  • CVE-2015-6599Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23416608.

  • CVE-2015-6598Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23306638.

  • CVE-2015-6596Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.01

    mediaserver in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, aka internal bugs 20731946 and 20719651, a different vulnerability than CVE-2015-7717.

  • CVE-2015-3879Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.01

    Media Player Framework in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, aka internal bug 23223325.

  • CVE-2015-3878Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.01

    Media Projection in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to bypass an intended screen-recording warning feature and obtain sensitive screen-snapshot information via a crafted application that references a long application name, aka internal…

  • CVE-2015-3877Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    Skia, as used in Android before 5.1.1 LMY48T, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20723696.

  • CVE-2015-3875Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.

  • CVE-2015-3874Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    The Sonivox components in Android before 5.1.1 LMY48T allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23335715, 23307276, and 23286323.

  • CVE-2015-3873Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23016072, 23248776, 23247055, 22845824, 22008959, 21814993, 21048776, 20718524, 20674674,…

  • CVE-2015-3872Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23346388.

  • CVE-2015-3871Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23031033.

  • CVE-2015-3870Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22771132.

  • CVE-2015-3869Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23036083.

  • CVE-2015-3868Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.03

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23270724.

  • CVE-2015-3867Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23213430.

  • CVE-2015-3865Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.01

    The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.

  • CVE-2015-3862Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.00

    mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22954006.

  • CVE-2015-3847Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.00

    Bluetooth in Android before 5.1.1 LMY48T allows attackers to remove stored SMS messages via a crafted application, aka internal bug 22343270.

  • CVE-2015-3823Oct 6, 2015
    Google
    Android
    risk 0.00cvss —epss 0.02

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 21335999.

  • CVE-2015-7686Oct 6, 2015
    Perl Foundation
    Email-Address
    risk 0.00cvss —epss 0.04

    Algorithmic complexity vulnerability in Address.pm in the Email-Address module 1.908 and earlier for Perl allows remote attackers to cause a denial of service (CPU consumption) via a crafted string containing a list of e-mail addresses in conjunction with parenthesis characters…

  • CVE-2015-7314Oct 6, 2015
    Gollum Project
    Gollum
    risk 0.00cvss —epss 0.02

    The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.

  • CVE-2015-6549Oct 6, 2015
    Symantec
    NetBackup OpsCenter
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in an application console in the server in Symantec NetBackup OpsCenter before 7.7.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-5652Oct 6, 2015
    Python (programming language)
    Python
    risk 0.00cvss —epss 0.01

    Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python…

  • CVE-2015-5650Oct 6, 2015
    Ajaxplorer
    Ajaxplorer
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in AjaXplorer 2.0 allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2015-5645Oct 6, 2015
    Icz
    Matchasns
    risk 0.00cvss —epss 0.01

    ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors.

  • CVE-2015-5644Oct 6, 2015
    Icz
    Matchasns
    risk 0.00cvss —epss 0.01

    The installer in ICZ MATCHA SNS before 1.3.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors.

  • CVE-2015-5643Oct 6, 2015
    Icz
    Matcha Invoice
    risk 0.00cvss —epss 0.01

    The installer in ICZ MATCHA INVOICE before 2.5.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors.

  • CVE-2015-5642Oct 6, 2015
    Icz
    Matcha Invoice
    risk 0.00cvss —epss 0.01

    Multiple SQL injection vulnerabilities in ICZ MATCHA INVOICE before 2.5.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2015-5641Oct 6, 2015
    Basercms
    Basercms
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2015-5640Oct 6, 2015
    Basercms
    Basercms
    risk 0.00cvss —epss 0.02

    baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request.

  • CVE-2015-5024Oct 6, 2015
    IBM
    Emptoris Sourcing
    risk 0.00cvss —epss 0.01

    IBM Emptoris Sourcing 10.0.2.0 before iFix6, 10.0.2.2 before iFix11, 10.0.2.3, 10.0.2.5 before iFix4, 10.0.2.6 before iFix8, 10.0.2.7 before iFix1, and 10.0.4.x before iFix2 allows remote authenticated users to obtain sensitive supplier-bid information via unspecified vectors.

  • CVE-2015-5022Oct 6, 2015
    IBM
    B2b Advanced Communications
    risk 0.00cvss —epss 0.01

    IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2, when access by guests is enabled, place an internal hostname and a payload path in a response, which allows remote authenticated users to obtain…

  • CVE-2015-4992Oct 6, 2015
    IBM
    Sterling B2b Integrator
    risk 0.00cvss —epss 0.01

    IBM Sterling B2B Integrator 5.2 before 5020500_8 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.

  • CVE-2015-4973Oct 6, 2015
    IBM
    B2b Advanced Communications
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 and 1.0.0.3 before 1.0.0.3_2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2015-4971Oct 6, 2015
    IBM
    Emptoris Program Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Emptoris Strategic Supply Management Platform and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote authenticated…

  • CVE-2015-4967Oct 6, 2015
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX004, and 7.6.0 before 7.6.0.1 IFIX002; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX004 and 7.6.0 before 7.6.0.1 IFIX002 for SmartCloud Control Desk; and Maximo Asset…

  • CVE-2015-4965Oct 6, 2015
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    maximouiweb/webmodule/webclient/utility/merlin.jsp in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX004, and 7.6.0 before 7.6.0.1 IFIX002; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX004 and 7.6.0 before 7.6.0.1 IFIX002 for SmartCloud Control…

  • CVE-2015-4964Oct 6, 2015
    IBM
    Urbancode Deploy
    risk 0.00cvss —epss 0.01

    IBM UrbanCode Deploy 6.0 and 6.0.1.x before 6.0.1.10, 6.1.1.x before 6.1.1.8, and 6.1.2 writes admin AUTH_TOKEN values to execution logs, which allows remote authenticated users to gain privileges by leveraging the ability to create and execute a process.

  • CVE-2015-4944Oct 6, 2015
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX003, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX003 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and…

  • CVE-2015-4939Oct 6, 2015
    IBM
    Emptoris Supplier Lifecycle Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Emptoris Supplier Lifecycle Management and Emptoris Program Management 10.x before 10.0.1.4_iFix3, 10.0.2.x before 10.0.2.7_iFix1, 10.0.3.x before 10.0.3.2, and 10.0.4.x before 10.0.4.0_iFix1 allows remote attackers to inject…

  • CVE-2015-3938Oct 6, 2015
    Mitsubishielectric
    Melsec Fx3g
    risk 0.00cvss —epss 0.02

    The HTTP application on Mitsubishi Electric MELSEC FX3G PLC devices before April 2015 allows remote attackers to cause a denial of service (device outage) via a long parameter.

  • CVE-2015-1015Oct 6, 2015
    Omron
    Cj2h Plc
    risk 0.00cvss —epss 0.00

    Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 use a reversible format for password storage in object files on Compact Flash cards, which makes it easier for local users to obtain sensitive information by reading a file.

  • CVE-2015-0988Oct 6, 2015
    Omron
    Cx Programmer
    risk 0.00cvss —epss 0.00

    Omron CX-One CX-Programmer before 9.6 uses a reversible format for password storage in project source-code files, which makes it easier for local users to obtain sensitive information by reading a file.

  • CVE-2015-0987CriOct 6, 2015
    Omron
    Cj2h Plc
    risk 0.65cvss 10.0epss 0.01

    Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request.

  • CVE-2014-9751Oct 6, 2015
    NTP
    NTP
    risk 0.00cvss —epss 0.05

    The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the…

  • CVE-2014-9750Oct 6, 2015
    NTP
    NTP
    risk 0.00cvss —epss 0.06

    ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for…

  • CVE-2015-7709Oct 5, 2015
    Knox Software
    Western Digital Arkeia
    risk 0.09cvss —epss 0.79

    The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation.

  • CVE-2015-7708Oct 5, 2015
    4homepages
    4images
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in 4images 1.7.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the cat_description parameter in an updatecat action to admin/categories.php.