VYPR

CVEs

396,199 total · page 6488 of 7,924

AllCriticalHighKEV
  • CVE-2015-3203Sep 28, 2015
    larsjung
    h5ai
    risk 0.04cvss —epss 0.09

    Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the href parameter.

  • CVE-2015-7387Sep 28, 2015
    Manageengine
    EventLog Analyzer
    risk 0.09cvss —epss 0.80

    ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT…

  • CVE-2015-7386Sep 28, 2015
    WordPress
    Gallery - Photo Albums - Portfolio
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) Media Title or (2) Media Subtitle fields.

  • CVE-2015-6928Sep 28, 2015
    Cubecart
    Cubecart
    risk 0.00cvss —epss 0.02

    classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate…

  • CVE-2015-5082Sep 28, 2015
    Endian
    Firewall
    risk 0.09cvss —epss 0.70

    Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.

  • CVE-2015-7383Sep 28, 2015
    Refbase
    Refbase
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge through 2015-04-28 allow remote attackers to inject arbitrary web script or HTML via the (1) adminUserName, (2) pathToMYSQL, (3) databaseStructureFile, or…

  • CVE-2015-7382Sep 28, 2015
    Refbase
    Refbase
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary SQL commands via the defaultCharacterSet parameter, a different issue than CVE-2015-6009.

  • CVE-2015-7381Sep 28, 2015
    Refbase
    Refbase
    risk 0.03cvss —epss 0.03

    Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.

  • CVE-2015-6463Sep 28, 2015
    Codewrights
    Hart Comm Dtm
    risk 0.00cvss —epss 0.01

    CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a longtag XML schema containing an external entity…

  • CVE-2015-6307Sep 28, 2015
    Cisco Systems, Inc.
    Firepower
    risk 0.00cvss —epss 0.01

    Cisco FirePOWER (formerly Sourcefire) 7000 and 8000 devices with software 5.4.0.1 allow remote attackers to cause a denial of service (inspection-engine outage) via crafted packets, aka Bug ID CSCuu10871.

  • CVE-2015-6280Sep 28, 2015
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.04

    The SSHv2 functionality in Cisco IOS 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.6E before 3.6.3E, 3.7E before 3.7.1E, 3.10S before 3.10.6S, 3.11S before 3.11.4S, 3.12S before 3.12.3S, 3.13S before 3.13.3S, and 3.14S before 3.14.1S does not properly implement RSA authentication,…

  • CVE-2015-6279Sep 28, 2015
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The IPv6 snooping functionality in the first-hop security subsystem in Cisco IOS 12.2, 15.0, 15.1, 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.2SE, 3.3SE, 3.3XO, 3.4SG, 3.5E, and 3.6E before 3.6.3E; 3.7E before 3.7.2E; 3.9S and 3.10S before 3.10.6S; 3.11S before 3.11.4S; 3.12S and…

  • CVE-2015-6278Sep 28, 2015
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.03

    The IPv6 snooping functionality in the first-hop security subsystem in Cisco IOS 12.2, 15.0, 15.1, 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.2SE, 3.3SE, 3.3XO, 3.4SG, 3.5E, and 3.6E before 3.6.3E; 3.7E before 3.7.2E; 3.9S and 3.10S before 3.10.6S; 3.11S before 3.11.4S; 3.12S and…

  • CVE-2015-6012Sep 28, 2015
    Refbase
    Refbase
    risk 0.00cvss —epss 0.01

    Multiple open redirect vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the referrer parameter.

  • CVE-2015-6011Sep 28, 2015
    Refbase
    Refbase
    risk 0.00cvss —epss 0.01

    Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allows remote attackers to conduct XML injection attacks via (1) the id parameter to unapi.php or (2) the stylesheet parameter to sru.php.

  • CVE-2015-6010Sep 28, 2015
    Refbase
    Refbase
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to inject arbitrary web script or HTML via the (1) errorNo or (2) errorMsg parameter to error.php; the (3)…

  • CVE-2015-6009Sep 28, 2015
    Refbase
    Refbase
    risk 0.03cvss —epss 0.02

    Multiple SQL injection vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary SQL commands via (1) the where parameter to rss.php or (2) the sqlQuery parameter to search.php, a different issue than CVE-2015-7382.

  • CVE-2015-6008Sep 28, 2015
    Refbase
    Refbase
    risk 0.03cvss —epss 0.05

    install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary commands via the adminPassword parameter, a different issue than CVE-2015-7381.

  • CVE-2015-6007Sep 28, 2015
    Refbase
    Refbase
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2015-3974Sep 28, 2015
    Easyio
    Easyio 30p Sf
    risk 0.00cvss —epss 0.02

    EasyIO EasyIO-30P-SF controllers with firmware before 0.5.21 and 2.x before 2.0.5.21, as used in Accutrol, Bar-Tech Automation, Infocon/EasyIO, Honeywell Automation India, Johnson Controls, SyxthSENSE, Transformative Wave Technologies, Tridium Asia Pacific, and Tridium Europe…

  • CVE-2014-9202Sep 28, 2015
    Advantech
    Webaccess
    risk 0.00cvss —epss 0.01

    Multiple stack-based buffer overflows in an unspecified DLL file in Advantech WebAccess before 8.0_20150816 allow remote attackers to execute arbitrary code via a crafted file that triggers long string arguments to functions.

  • CVE-2015-6475Sep 26, 2015
    Danfoss
    TLX Pro+
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-6474Sep 26, 2015
    Danfoss
    TLX Pro+
    risk 0.00cvss —epss 0.01

    IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to discover cleartext passwords by reading HTML source code.

  • CVE-2015-6470Sep 26, 2015
    Resource Data Management Data Manager
    Data Manager
    risk 0.00cvss —epss 0.01

    Resource Data Management Data Manager before 2.2 allows remote authenticated users to modify arbitrary passwords via unspecified vectors.

  • CVE-2015-6469Sep 26, 2015
    Danfoss
    TLX Pro+
    risk 0.00cvss —epss 0.01

    The interpreter in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allows remote attackers to discover script source code via unspecified vectors.

  • CVE-2015-6468Sep 26, 2015
    Resource Data Management Data Manager
    Data Manager
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Resource Data Management Data Manager before 2.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2015-6454Sep 26, 2015
    Everest
    Peakhmi
    risk 0.00cvss —epss 0.03

    Everest PeakHMI before 8.7.0.2, when the video server is used, allows remote attackers to cause a denial of service (incorrect pointer dereference and daemon crash) via a crafted packet.

  • CVE-2015-6306Sep 26, 2015
    Cisco Systems, Inc.
    Anyconnect Secure Mobility Client
    risk 0.03cvss —epss 0.01

    Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions, which allows local users to obtain root privileges via a crafted installation file, aka Bug ID CSCuv11947.

  • CVE-2015-6305Sep 26, 2015
    Cisco Systems, Inc.
    Anyconnect Secure Mobility Client
    risk 0.03cvss —epss 0.01

    Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConnect Secure Mobility Client 2.0 through 4.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, as…

  • CVE-2015-6302Sep 26, 2015
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.02

    The RADIUS functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.0(250.0) and 7.0(252.0) allows remote attackers to disconnect arbitrary sessions via crafted Disconnect-Request UDP packets, aka Bug ID CSCuw29419.

  • CVE-2015-6282Sep 26, 2015
    Cisco Systems, Inc.
    iOS Xe
    risk 0.00cvss —epss 0.02

    Cisco IOS XE 2.x and 3.x before 3.10.6S, 3.11.xS through 3.13.xS before 3.13.3S, and 3.14.xS through 3.15.xS before 3.15.1S allows remote attackers to cause a denial of service (device reload) via IPv4 packets that require NAT and MPLS actions, aka Bug ID CSCut96933.

  • CVE-2015-4543Sep 26, 2015
    EMC Corporation
    Rsa Archer Egrc
    risk 0.00cvss —epss 0.02

    EMC RSA Archer GRC 5.x before 5.5.3 uses cleartext for stored passwords in unspecified circumstances, which allows remote authenticated users to obtain sensitive information by reading database fields.

  • CVE-2015-4542Sep 26, 2015
    EMC Corporation
    Rsa Archer Egrc
    risk 0.00cvss —epss 0.03

    EMC RSA Archer GRC 5.x before 5.5.3 allows remote authenticated users to bypass intended access restrictions, and read or modify Discussion Forum Fields messages, via unspecified vectors.

  • CVE-2015-4541Sep 26, 2015
    EMC Corporation
    Rsa Archer Egrc
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer GRC 5.x before 5.5.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-4540Sep 26, 2015
    EMC Corporation
    Rsa Identity Management And Governance
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Identity Management & Governance (IMG) before 6.8.1 P18 and 6.9.x before 6.9.1 P6 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-4539Sep 26, 2015
    EMC Corporation
    Rsa Identity Management And Governance
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Identity Management & Governance (IMG) before 7.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-7375Sep 25, 2015
    Indusoft
    Web Studio
    risk 0.00cvss —epss 0.02

    Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service (unhandled runtime exception and application crash) via a crafted Indusoft Project file.

  • CVE-2015-7374Sep 25, 2015
    Indusoft
    Web Studio
    risk 0.00cvss —epss 0.03

    The Remote Agent component in Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-2649.

  • CVE-2015-6304Sep 24, 2015
    Cisco Systems, Inc.
    Telepresence Server Software
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Server software 3.0(2.24) allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCut63718, CSCut63724, and CSCut63760.

  • CVE-2015-6303Sep 24, 2015
    Cisco Systems, Inc.
    Spark
    risk 0.00cvss —epss 0.01

    The Cisco Spark application 2015-07-04 for mobile operating systems does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCut36742 and…

  • CVE-2015-7327Sep 24, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to track last-level cache access, and consequently obtain sensitive information, via crafted JavaScript code that makes performance.now calls.

  • CVE-2015-7180Sep 24, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The ReadbackResultWriterD3D11::Run function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 misinterprets the return value of a function call, which might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly…

  • CVE-2015-7179Sep 24, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The VertexBufferInterface::reserveVertexSpace function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, incorrectly allocates memory for shader attribute arrays, which allows remote attackers to execute arbitrary code or…

  • CVE-2015-7178Sep 24, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The ProgramBinary::linkAttributes function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, mishandles shader access, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption…

  • CVE-2015-7177Sep 24, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The InitTextures function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.

  • CVE-2015-7176Sep 24, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The AnimationThread function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 uses an incorrect argument to the sscanf function, which might allow remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have…

  • CVE-2015-7175Sep 24, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The XULContentSinkImpl::AddText function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to…

  • CVE-2015-7174Sep 24, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to…

  • CVE-2015-4522Sep 24, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The nsUnicodeToUTF8::GetMaxLength function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related…

  • CVE-2015-4521Sep 24, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The ConvertDialogOptions function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.