VYPR

CVEs

396,200 total · page 6486 of 7,924

AllCriticalHighKEV
  • CVE-2015-7707Oct 5, 2015
    Igniterealtime
    Openfire
    risk 0.03cvss —epss 0.06

    Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp.

  • CVE-2015-7323Oct 5, 2015
    Juniper Networks
    Pulse Connect Secure
    risk 0.00cvss —epss 0.02

    The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 allows remote authenticated users to bypass intended access restrictions and log into arbitrary meetings by leveraging a…

  • CVE-2015-7322Oct 5, 2015
    Juniper Networks
    Pulse Connect Secure
    risk 0.00cvss —epss 0.02

    The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 provides different messages for attempts to join a meeting depending on the status of the meeting, which allows remote…

  • CVE-2015-7685Oct 5, 2015
    Glpi Project
    Glpi
    risk 0.00cvss —epss 0.02

    GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the _profiles_id parameter to front/user.form.php.

  • CVE-2015-7684Oct 5, 2015
    Glpi Project
    Glpi
    risk 0.00cvss —epss 0.04

    Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket, then accessing it via a direct request to the file in files/_tmp/.

  • CVE-2015-7392Oct 5, 2015
    Signalwire
    Freeswitch
    risk 0.00cvss —epss 0.05

    Heap-based buffer overflow in the parse_string function in libs/esl/src/esl_json.c in FreeSWITCH before 1.4.23 and 1.6.x before 1.6.2 allows remote attackers to execute arbitrary code via a trailing \u in a json string to cJSON_Parse.

  • CVE-2015-5687Oct 5, 2015
    Anchorcms
    Anchor CMS
    risk 0.00cvss —epss 0.03

    system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie.

  • CVE-2015-4930Oct 4, 2015
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.02

    IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin access.

  • CVE-2015-2031Oct 4, 2015
    IBM
    Websphere Extreme Scale
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2015-2030Oct 4, 2015
    IBM
    Websphere Extreme Scale
    risk 0.00cvss —epss 0.01

    IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 has an improper account-lockout setting, which makes it easier for remote attackers to obtain access via a brute-force attack.

  • CVE-2015-2029Oct 4, 2015
    IBM
    Websphere Extreme Scale
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier.

  • CVE-2015-2028Oct 4, 2015
    IBM
    Websphere Extreme Scale
    risk 0.00cvss —epss 0.01

    CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.

  • CVE-2015-2027Oct 4, 2015
    IBM
    Websphere Extreme Scale
    risk 0.00cvss —epss 0.01

    IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 improperly performs logout actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.

  • CVE-2015-2026Oct 4, 2015
    IBM
    Websphere Extreme Scale
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

  • CVE-2015-2025Oct 4, 2015
    IBM
    Websphere Extreme Scale
    risk 0.00cvss —epss 0.01

    IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

  • CVE-2015-2016Oct 4, 2015
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors.

  • CVE-2015-2011Oct 4, 2015
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.02

    The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.

  • CVE-2015-1988Oct 4, 2015
    IBM
    Tivoli Storage Flashcopy Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 and Tivoli Storage FlashCopy Manager for VMware 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1…

  • CVE-2015-1983Oct 4, 2015
    IBM
    Urbancode Build
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Projects page in IBM UrbanCode Build 6.1.x before 6.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2015-1969Oct 4, 2015
    IBM
    Tivoli Common Reporting
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Tivoli Common Reporting (TCR) 2.1 before IF13 and 2.1.1 before IF21, and TCR 3.1.x as used in Cognos Business Intelligence before 10.2 IF0015 and other products, allows remote authenticated users to inject arbitrary web script or…

  • CVE-2015-1934Oct 4, 2015
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.01

    IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX002, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX002 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13…

  • CVE-2015-1933Oct 4, 2015
    IBM
    Maximo Asset Management
    risk 0.00cvss —epss 0.00

    IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX001 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13…

  • CVE-2015-5651Oct 3, 2015
    Dotclear
    Dotclear
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Dotclear before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-4955Oct 3, 2015
    IBM
    Business Process Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 before 8.5.6.0 CF1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2015-1888Oct 3, 2015
    IBM
    Content Navigator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in Content Manager, FileNet Content Manager, Content Foundation, Content Manager OnDemand, and other products, allows remote authenticated…

  • CVE-2015-0195Oct 3, 2015
    IBM
    Content Template Catalog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Content Template Catalog 4.x before 4.1.4 for WebSphere Portal 8.0.x and 4.x before 4.3.1 for WebSphere Portal 8.5.x allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2015-0145Oct 3, 2015
    IBM
    Openpages Grc Platform
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.

  • CVE-2015-0144Oct 3, 2015
    IBM
    Openpages Grc Platform
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than…

  • CVE-2015-0143Oct 3, 2015
    IBM
    Openpages Grc Platform
    risk 0.00cvss —epss 0.01

    IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to obtain sensitive information by reading error messages.

  • CVE-2015-0142Oct 3, 2015
    IBM
    Openpages Grc Platform
    risk 0.00cvss —epss 0.01

    IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to cause a denial of service (maintenance-mode transition and data-storage outage) by calling the System Administration Mode function.

  • CVE-2015-0141Oct 3, 2015
    IBM
    Openpages Grc Platform
    risk 0.00cvss —epss 0.01

    IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to modify arbitrary user filters via a JSON request.

  • CVE-2014-8916Oct 3, 2015
    IBM
    Openpages Grc Platform
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than…

  • CVE-2015-6309Oct 2, 2015
    Cisco Systems, Inc.
    Email Security Appliance Firmware
    risk 0.00cvss —epss 0.02

    Cisco Email Security Appliance (ESA) 8.5.6-106 and 9.6.0-042 allows remote authenticated users to cause a denial of service (file-descriptor consumption and device reload) via crafted HTTP requests, aka Bug ID CSCuw32211.

  • CVE-2015-6308Oct 2, 2015
    Cisco Systems, Inc.
    Nx OS
    risk 0.00cvss —epss 0.02

    Cisco NX-OS 6.0(2)U6(0.46) on N3K devices allows remote authenticated users to cause a denial of service (temporary SNMP outage) via an SNMP request for an OID that does not exist, aka Bug ID CSCuw36684.

  • CVE-2015-5653Oct 2, 2015
    Canarylabs
    Trend Web Server
    risk 0.00cvss —epss 0.03

    Buffer overflow in Canary Labs Trend Web Server before 9.5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet.

  • CVE-2015-6602Oct 2, 2015
    Google
    Android
    risk 0.00cvss —epss 0.03

    libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.

  • CVE-2015-4546Oct 2, 2015
    EMC Corporation
    Rsa Certificate Manager
    risk 0.00cvss —epss 0.03

    Directory traversal vulnerability in EMC RSA OneStep 6.9 before build 559, as used in RSA Certificate Manager and RSA Registration Manager through 6.9 build 558 and other products, allows remote attackers to read arbitrary files via a crafted KCSOSC_ERROR_PAGE parameter.

  • CVE-2015-3876Oct 2, 2015
    Google
    Android
    risk 0.00cvss —epss 0.03

    libstagefright in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.

  • CVE-2015-2858Oct 2, 2015
    Datalex
    Airline Booking Software
    risk 0.00cvss —epss 0.02

    Datalex airline booking software before 2015-09-03 allows remote attackers to read or write to arbitrary user data via a modified profileId parameter to (1) ValidateFormAction.do or (2) ProfileConfirmEditAddressAction.do.

  • CVE-2015-7612Oct 1, 2015
    McAfee
    Vulnerability Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Organizations page in Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that have unspecified impact via…

  • CVE-2015-7311Oct 1, 2015
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.

  • CVE-2015-7236HigOct 1, 2015
    Rpcbind
    Rpcbind
    risk 0.49cvss 7.5epss 0.06

    Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

  • CVE-2015-1338Oct 1, 2015
    Apport Project
    Apport
    risk 0.03cvss —epss 0.01

    kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.

  • CVE-2015-1335Oct 1, 2015
    Lxc
    Lxc
    risk 0.00cvss —epss 0.00

    lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.

  • CVE-2015-6575Oct 1, 2015
    Google
    Android
    risk 0.00cvss —epss 0.03

    SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted atoms in MP4 data, aka…

  • CVE-2015-3864Oct 1, 2015
    Google
    Android
    risk 0.10cvss —epss 0.87

    Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability…

  • CVE-2015-3863Oct 1, 2015
    Google
    Android
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob in an insert operation, aka internal bug…

  • CVE-2015-3861Oct 1, 2015
    Google
    Android
    risk 0.00cvss —epss 0.01

    Multiple integer overflows in the addVorbisCodecInfo function in matroska/MatroskaExtractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allow remote attackers to cause a denial of service (device inoperability) via crafted Matroska data, aka internal bug…

  • CVE-2015-3860Oct 1, 2015
    Google
    Android
    risk 0.00cvss —epss 0.00

    packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long…

  • CVE-2015-3858Oct 1, 2015
    Google
    Android
    risk 0.00cvss —epss 0.01

    The checkDestination function in internal/telephony/SMSDispatcher.java in Android before 5.1.1 LMY48M relies on an obsolete permission name for an authorization check, which allows attackers to bypass an intended user-confirmation requirement for SMS short-code messaging via a…