VYPR

CVEs

396,199 total · page 6493 of 7,924

AllCriticalHighKEV
  • CVE-2015-3801Sep 18, 2015
    Apple Inc.
    Webkit
    risk 0.00cvss —epss 0.02

    The document.cookie API implementation in the CFNetwork Cookies subsystem in WebKit in Apple iOS before 9 allows remote attackers to bypass an intended single-cookie restriction via unspecified vectors.

  • CVE-2014-8611Sep 18, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    The __sflush function in fflush.c in stdio in libc in FreeBSD 10.1 and the kernel in Apple iOS before 9 mishandles failures of the write system call, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via…

  • CVE-2015-7235Sep 17, 2015
    WordPress
    CP Reservation Calendar
    risk 0.00cvss —epss 0.05

    Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a dex_reservations_calendar_load2 action or (2) dex_item parameter…

  • CVE-2015-7234Sep 17, 2015
    Drupal
    OSF
    risk 0.00cvss —epss 0.02

    The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors.

  • CVE-2015-7233Sep 17, 2015
    Drupal
    OSF
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Import module is enabled, allows remote attackers to hijack the authentication of administrators for requests that create new OSF datasets via unspecified vectors.

  • CVE-2015-7232Sep 17, 2015
    Drupal
    OSF
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology module is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-7231Sep 17, 2015
    Drupal
    Commerce Commonwealth
    risk 0.00cvss —epss 0.01

    The Commerce Commonwealth (CBA) module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."

  • CVE-2015-7230Sep 17, 2015
    Workbench Email Project
    Workbench Email
    risk 0.00cvss —epss 0.01

    The Workbench Email module 7.x-3.x before 7.x-3.4 for Drupal allows remote authenticated users with certain permissions to bypass node and field validation by saving a node.

  • CVE-2015-7229Sep 17, 2015
    Drupal
    Twitter
    risk 0.00cvss —epss 0.01

    The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the (1) "post to twitter" permission or…

  • CVE-2015-7228Sep 17, 2015
    Drupal
    RESTful module
    risk 0.00cvss —epss 0.01

    The RESTful module 7.x-1.x before 7.x-1.3 for Drupal does not properly cache pages of authenticated users when using non-cookie authentication providers, which allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2015-7227Sep 17, 2015
    Drupal
    Fieldable Panels Panes
    risk 0.00cvss —epss 0.01

    The Fieldable Panels Panes module 7.x-1.x before 7.x-1.7 for Drupal does not properly check permissions to edit Fieldable Panels Panes entities, which allows remote authenticated users to edit panes by leveraging permissions to edit panels.

  • CVE-2015-7226Sep 17, 2015
    Administration Views Project
    Administration Views
    risk 0.00cvss —epss 0.02

    The Administration Views module 7.x-1.x before 7.x-1.5 for Drupal checks access permissions based on the router path from the view instead of the display property, which allows remote attackers to obtain sensitive information via vectors related to the access handler.

  • CVE-2015-6672Sep 17, 2015
    Citrix Systems
    Netscaler Application Delivery Controller
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 132.8, 10.5 before Build 57.7, and 10.5e before Build 56.1505.e allows remote attackers to inject…

  • CVE-2015-5538Sep 17, 2015
    Citrix Systems
    Netscaler Application Delivery Controller Firmware
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 132.8, 10.5 before Build 57.7, and 10.5e before Build 56.1505.e allow remote attackers to gain privileges via unknown vectors, related to the…

  • CVE-2015-4040Sep 17, 2015
    F5, Inc.
    Big IP
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the web root via unspecified vectors.

  • CVE-2015-1319Sep 17, 2015
    Canonical
    Ubuntu Linux
    risk 0.00cvss —epss 0.00

    The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 does not properly detect if the screen is locked, which allows physically proximate attackers to mount removable media while the screen is locked as demonstrated…

  • CVE-2015-6962Sep 17, 2015
    Farol
    Farol
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the web application in Farol allows remote attackers to execute arbitrary SQL commands via the email parameter to tkmonitor/estrutura/login/Login.actions.php.

  • CVE-2015-6973Sep 16, 2015
    Igniterealtime
    Openfire
    risk 0.08cvss —epss 0.65

    Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted…

  • CVE-2015-6972Sep 16, 2015
    Igniterealtime
    Openfire
    risk 0.04cvss —epss 0.08

    Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1) groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the (2) urlName parameter to…

  • CVE-2015-6929Sep 16, 2015
    Nokia
    @vantage Commander
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Nokia Networks (formerly Nokia Solutions and Networks and Nokia Siemens Networks) @vantage Commander allow remote attackers to inject arbitrary web script or HTML via the (1) idFilter or (2) nameFilter parameter to…

  • CVE-2015-5465Sep 16, 2015
    Silicon Integrated Systems
    WindowsXP Display Manager
    risk 0.03cvss —epss 0.01

    Silicon Integrated Systems WindowsXP Display Manager (aka VGA Driver Manager and VGA Display Manager) 6.14.10.3930 allows local users to gain privileges via a crafted (1) 0x96002400 or (2) 0x96002404 IOCTL call.

  • CVE-2015-3623Sep 16, 2015
    Qlik
    Qlikview
    risk 0.04cvss —epss 0.16

    XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx.

  • CVE-2015-1173Sep 16, 2015
    Unit4
    Teta Web
    risk 0.00cvss —epss 0.02

    Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 does not properly restrict access to the (1) Design Mode and (2) Debug Logger mode modules, which allows remote attackers to gain privileges via crafted "received parameters."

  • CVE-2014-8778Sep 16, 2015
    Checkmarx
    Cxsast
    risk 0.00cvss —epss 0.03

    Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote authenticated users to bypass the CxQL sandbox protection mechanism and execute arbitrary C# code by asserting the (1) System.Security.Permissions.PermissionState.Unrestricted or (2)…

  • CVE-2015-6969Sep 16, 2015
    Serendipity
    Serendipity
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link.

  • CVE-2015-6968Sep 16, 2015
    S9y
    Serendipity
    risk 0.00cvss —epss 0.02

    Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht or (2) .phtml extension.

  • CVE-2015-6967Sep 16, 2015
    Nibbleblog
    Nibbleblog
    risk 0.07cvss —epss 0.49

    Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…

  • CVE-2015-6966Sep 16, 2015
    Nibbleblog
    Nibbleblog
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that (1) create a post via a new_simple action to admin.php or (2) conduct cross-site scripting (XSS) attacks…

  • CVE-2015-6965Sep 16, 2015
    WordPress
    Contact Form Generator
    risk 0.03cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) create a field, (2) update a field, (3) delete a field, (4)…

  • CVE-2015-6829Sep 16, 2015
    Ciphercoin
    Wp Limit Login Attempts
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the getip function in wp-limit-login-attempts.php in the WP Limit Login Attempts plugin before 2.0.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) X-Forwarded-For or (2) Client-IP HTTP header.

  • CVE-2015-6828Sep 16, 2015
    Securemoz
    Security Audit
    risk 0.00cvss —epss 0.02

    The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute…

  • CVE-2015-5956Sep 16, 2015
    TYPO3
    Typo3
    risk 0.00cvss —epss 0.02

    The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter…

  • CVE-2015-5440Sep 16, 2015
    HPE
    HP UCMDB
    risk 0.00cvss —epss 0.01

    HP UCMDB 10.00 and 10.01 before 10.01CUP12, 10.10 and 10.11 before 10.11CUP6, and 10.2x before 10.21 allows local users to obtain sensitive information via unspecified vectors.

  • CVE-2015-2136Sep 16, 2015
    Microfocus
    ArcSight Logger
    risk 0.00cvss —epss 0.02

    HP ArcSight Logger before 6.0 P2 allows remote authenticated users to bypass the intended authorization policy via unspecified vectors.

  • CVE-2015-5426Sep 16, 2015
    Microfocus
    Loadrunner
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in HP LoadRunner Controller before 12.50 allows local users to gain privileges via unknown vectors, aka ZDI-CAN-2756.

  • CVE-2015-6949Sep 15, 2015
    Asus
    TM-AC1900
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in the ASUS TM-AC1900 router allows remote attackers to execute arbitrary code via crafted HTTP header values.

  • CVE-2015-6948Sep 15, 2015
    NOS Microsystems
    Wordperfect
    risk 0.00cvss —epss 0.04

    Heap-based buffer overflow in the Microsoft Word document conversion feature in Corel WordPerfect allows remote attackers to execute arbitrary code via a crafted document.

  • CVE-2015-6946Sep 15, 2015
    Microfocus
    Accurev
    risk 0.02cvss —epss 0.21

    Multiple stack-based buffer overflows in the Reprise License Manager service in Borland AccuRev allow remote attackers to execute arbitrary code via the (1) akey or (2) actserver parameter to the activate_doit function or (3) licfile parameter to the service_startup_doit…

  • CVE-2015-6945Sep 15, 2015
    Jsp\/mysql Administrador Web Project
    Jsp\/mysql Administrador Web
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to inject arbitrary web script or HTML via the bd parameter to sys/sys/listaBD2.jsp.

  • CVE-2015-6944Sep 15, 2015
    Jsp\/mysql Administrador Web Project
    Jsp\/mysql Administrador Web
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in JSP/MySQL Administrador Web 1 allows remote attackers to hijack the authentication of users for requests that execute arbitrary SQL commands via the cmd parameter to sys/sys/listaBD2.jsp.

  • CVE-2015-6943Sep 15, 2015
    Serendipity
    Serendipity
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL commands via the…

  • CVE-2015-5472Sep 15, 2015
    WordPress
    IBS Mappro
    risk 0.00cvss —epss 0.03

    Absolute path traversal vulnerability in lib/download.php in the IBS Mappro plugin before 1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter.

  • CVE-2015-4947Sep 15, 2015
    IBM
    HTTP Server
    risk 0.01cvss —epss 0.08

    Stack-based buffer overflow in the Administration Server in IBM HTTP Server 6.1.0.x through 6.1.0.47, 7.0.0.x before 7.0.0.39, 8.0.0.x before 8.0.0.12, and 8.5.x before 8.5.5.7, as used in WebSphere Application Server and other products, allows remote authenticated users to…

  • CVE-2015-4980Sep 14, 2015
    IBM
    Websphere Commerce
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in IBM WebSphere Commerce 7.0.0.6 through 7.0.0.9 allows remote authenticated users to obtain sensitive personal information via unknown vectors.

  • CVE-2015-1943Sep 14, 2015
    IBM
    Websphere Portal
    risk 0.00cvss —epss 0.03

    IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.

  • CVE-2014-9745Sep 14, 2015
    FreeType
    Freetype
    risk 0.00cvss —epss 0.04

    The parse_encoding function in type1/t1load.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (infinite loop) via a "broken number-with-base" in a Postscript stream, as demonstrated by 8#garbage.

  • CVE-2015-5998Sep 14, 2015
    Impero Software
    Education Pro
    risk 0.00cvss —epss 0.03

    Impero Education Pro before 5105 relies on the -1|AUTHENTICATE\x02PASSWORD string for authentication, which allows remote attackers to execute arbitrary programs via an encrypted command.

  • CVE-2015-5997Sep 14, 2015
    Impero Software
    Education Pro
    risk 0.00cvss —epss 0.02

    Impero Education Pro before 5105 uses a hardcoded CBC key and initialization vector derived from a hash of the Imp3ro string, which makes it easier for remote attackers to obtain plaintext data by sniffing the network for ciphertext data.

  • CVE-2015-6830Sep 14, 2015
    PhpMyAdmin
    phpMyAdmin
    risk 0.00cvss —epss 0.10

    libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single…

  • CVE-2015-6290Sep 14, 2015
    Cisco Systems, Inc.
    Web Security Appliance
    risk 0.00cvss —epss 0.01

    Cisco Web Security Appliance (WSA) 8.0.7 allows remote HTTP servers to cause a denial of service (memory consumption from stale TCP connections) via crafted responses, aka Bug ID CSCuw10426.