VYPR

CVEs

396,199 total · page 6494 of 7,924

AllCriticalHighKEV
  • CVE-2015-6288Sep 14, 2015
    Cisco Systems, Inc.
    Content Security Management Appliance
    risk 0.00cvss —epss 0.02

    Cisco Content Security Management Appliance (SMA) 7.8.0-000 does not properly validate credentials, which allows remote attackers to cause a denial of service (rapid log-file rollover and application fault) via crafted HTTP requests, aka Bug ID CSCuw09620.

  • CVE-2015-6287Sep 14, 2015
    Cisco Systems, Inc.
    Web Security Appliance
    risk 0.00cvss —epss 0.02

    Cisco Web Security Appliance (WSA) 8.0.6-078 and 8.0.6-115 allows remote attackers to cause a denial of service (service outage) via a flood of TCP traffic that leads to DNS resolution delays, aka Bug IDs CSCur32005 and CSCur07907.

  • CVE-2015-6286Sep 14, 2015
    Cisco Systems, Inc.
    Application Visibility And Control
    risk 0.00cvss —epss 0.01

    Cisco Application Visibility and Control (AVC) 15.3(3)JA, when FlexConnect is enabled, allows remote attackers to cause a denial of service (access-point outage) via a crafted UDP packet, aka Bug ID CSCuu47016.

  • CVE-2015-6285Sep 14, 2015
    Cisco Systems, Inc.
    Email Security Appliance Firmware
    risk 0.00cvss —epss 0.01

    Format string vulnerability in Cisco Email Security Appliance (ESA) 7.6.0 and 8.0.0 allows remote attackers to cause a denial of service (memory overwrite or service outage) via format string specifiers in an HTTP request, aka Bug ID CSCug21497.

  • CVE-2015-4499Sep 14, 2015
    Mozilla Corporation
    Bugzilla
    risk 0.00cvss —epss 0.03

    Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows remote attackers to obtain the default privileges for an arbitrary domain name by placing that name…

  • CVE-2015-2013Sep 14, 2015
    IBM
    Websphere Mq
    risk 0.00cvss —epss 0.02

    IBM WebSphere MQ 7.0.1 before 7.0.1.13 allows remote attackers to cause a denial of service (channel-agent abend and process outage) via a crafted selection string in an MQI call.

  • CVE-2015-5630Sep 11, 2015
    NTT Broadband Platform
    Japan Connected-free Wi-Fi
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted SSID.

  • CVE-2015-5629Sep 11, 2015
    NTT Broadband Platform
    Japan Connected-free Wi-Fi
    risk 0.00cvss —epss 0.01

    The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.

  • CVE-2015-6921Sep 11, 2015
    Zendesk
    Zendesk Feedback Tab
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Zendesk Feedback Tab module 7.x-1.x before 7.x-1.1 for Drupal allows remote administrators with the "Configure Zendesk Feedback Tab" permission to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-6920Sep 11, 2015
    WordPress
    sourceAFRICA
    risk 0.00cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.

  • CVE-2015-6919Sep 11, 2015
    Googlesearch Project
    Googlesearch
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the googleSearch (CSE) (com_googlesearch_cse) component 3.0.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the q parameter to index.php.

  • CVE-2014-7216Sep 11, 2015
    Yahoo
    Messenger
    risk 0.01cvss —epss 0.07

    Multiple stack-based buffer overflows in Yahoo! Messenger 11.5.0.228 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the (1) shortcut or (2) title keys in an emoticons.xml file.

  • CVE-2015-6915Sep 11, 2015
    Montala
    Resourcespace
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier allows remote attackers to execute arbitrary SQL commands via the "user" cookie to plugins/feedback/pages/feedback.php.

  • CVE-2015-6914Sep 11, 2015
    SiteFactory
    CMS
    risk 0.00cvss —epss 0.03

    Absolute path traversal vulnerability in SiteFactory CMS 5.5.9 allows remote attackers to read arbitrary files via a full pathname in the file parameter to assets/download.aspx.

  • CVE-2015-6913Sep 11, 2015
    Synology
    Download Station
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the "Create download task via URL" feature in Synology Download Station before 3.5-2967 allows remote attackers to inject arbitrary web script or HTML via the urls parameter in an add_url_task action to dlm/downloadman.cgi.

  • CVE-2015-6912Sep 11, 2015
    Synology
    Video Station
    risk 0.04cvss —epss 0.12

    Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi.

  • CVE-2015-6911Sep 11, 2015
    Synology
    Video Station
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi.

  • CVE-2015-6910Sep 11, 2015
    Synology
    Video Station
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi.

  • CVE-2015-6909Sep 11, 2015
    Synology
    Download Station
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file.

  • CVE-2015-6908Sep 11, 2015
    OpenLDAP
    Openldap
    risk 0.05cvss —epss 0.20

    The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.

  • CVE-2015-6675Sep 11, 2015
    Siemens Foundation
    Ros
    risk 0.00cvss —epss 0.01

    Siemens RUGGEDCOM ROS 3.8.0 through 4.1.x permanently enables the IP forwarding feature, which allows remote attackers to bypass a VLAN isolation protection mechanism via IP traffic.

  • CVE-2015-6466Sep 11, 2015
    Moxa
    EDS-405A and EDS-408A switches
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Diagnosis Ping feature in the administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote attackers to inject arbitrary web script or HTML via an unspecified field.

  • CVE-2015-6465Sep 11, 2015
    Moxa
    EDS-405A
    risk 0.00cvss —epss 0.03

    The GoAhead web server on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to cause a denial of service (reboot) via a crafted URL.

  • CVE-2015-6464Sep 11, 2015
    Moxa
    EDS-405A
    risk 0.00cvss —epss 0.03

    The administrative web interface on Moxa EDS-405A and EDS-408A switches with firmware before 3.6 allows remote authenticated users to bypass a read-only protection mechanism by using Firefox with a web-developer plugin.

  • CVE-2015-5631Sep 11, 2015
    Canon
    PIXMA MG7500
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Remote UI on Canon PIXMA MG7500 printers allows remote attackers to hijack the authentication of administrators.

  • CVE-2015-3964Sep 11, 2015
    SMA Solar Technology
    Sunny WebBox
    risk 0.00cvss —epss 0.03

    SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-9208Sep 11, 2015
    Advantech
    Webaccess
    risk 0.04cvss —epss 0.09

    Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2015-6827Sep 11, 2015
    Auto Exchanger
    Auto Exchanger
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in Auto-Exchanger 5.1.0 allows remote attackers to hijack the authentication of users for requests that change a password via a request to signup.php.

  • CVE-2015-6584Sep 11, 2015
    Sprymedia
    Datatables
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.

  • CVE-2015-6681Sep 9, 2015
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.06

    Adobe Shockwave Player before 12.2.0.162 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-6680.

  • CVE-2015-6680Sep 9, 2015
    Adobe Inc.
    Shockwave Player
    risk 0.00cvss —epss 0.05

    Adobe Shockwave Player before 12.2.0.162 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-6681.

  • CVE-2015-2546HigKEVSep 9, 2015
    Microsoft
    Windows
    risk 0.72cvss 8.2epss 0.10

    The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k…

  • CVE-2015-2545HigKEVSep 9, 2015
    Microsoft
    Office
    risk 0.70cvss 7.8epss 0.86

    Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability."

  • CVE-2015-2544Sep 9, 2015
    Microsoft
    Exchange Server
    risk 0.01cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."

  • CVE-2015-2543Sep 9, 2015
    Microsoft
    Exchange Server
    risk 0.01cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."

  • CVE-2015-2542Sep 9, 2015
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.20

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability."

  • CVE-2015-2541Sep 9, 2015
    Microsoft
    Internet Explorer
    risk 0.02cvss —epss 0.19

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2491.

  • CVE-2015-2536Sep 9, 2015
    Microsoft
    Lync Server
    risk 0.01cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability."

  • CVE-2015-2535Sep 9, 2015
    Microsoft
    Windows Server 2008
    risk 0.01cvss —epss 0.12

    Active Directory in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service outage) by creating multiple machine accounts, aka "Active Directory Denial of Service Vulnerability."

  • CVE-2015-2534Sep 9, 2015
    Microsoft
    Windows Server 2012
    risk 0.00cvss —epss 0.02

    Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 improperly processes ACL settings, which allows local users to bypass intended network-traffic restrictions via a crafted application, aka "Hyper-V Security Feature Bypass Vulnerability."

  • CVE-2015-2532Sep 9, 2015
    Microsoft
    Lync Server
    risk 0.01cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability."

  • CVE-2015-2531Sep 9, 2015
    Microsoft
    Lync Server
    risk 0.01cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Information…

  • CVE-2015-2530Sep 9, 2015
    Microsoft
    Windows
    risk 0.01cvss —epss 0.16

    Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka…

  • CVE-2015-2529Sep 9, 2015
    Microsoft
    Windows Server 2012
    risk 0.00cvss —epss 0.02

    The kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Kernel ASLR Bypass Vulnerability."

  • CVE-2015-2528Sep 9, 2015
    Microsoft
    Windows
    risk 0.03cvss —epss 0.03

    Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows Task Management Elevation of Privilege…

  • CVE-2015-2527Sep 9, 2015
    Microsoft
    Windows 8
    risk 0.04cvss —epss 0.07

    The process-initialization implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 does not properly constrain impersonation levels, which allows local users to gain…

  • CVE-2015-2526Sep 9, 2015
    Microsoft
    .net Framework
    risk 0.02cvss —epss 0.24

    Microsoft .NET Framework 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to cause a denial of service to an ASP.NET web site via crafted requests, aka "MVC Denial of Service Vulnerability."

  • CVE-2015-2525Sep 9, 2015
    Microsoft
    Windows
    risk 0.06cvss —epss 0.31

    Task Scheduler in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to bypass intended filesystem restrictions and delete arbitrary…

  • CVE-2015-2524Sep 9, 2015
    Microsoft
    Windows 8
    risk 0.03cvss —epss 0.03

    Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows Task Management Elevation of Privilege…

  • CVE-2015-2523Sep 9, 2015
    Microsoft
    Excel
    risk 0.05cvss —epss 0.30

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption…