VYPR

CVEs

396,198 total · page 6496 of 7,924

AllCriticalHighKEV
  • CVE-2015-6818Sep 6, 2015
    FFmpeg
    Ffmpeg
    risk 0.00cvss —epss 0.02

    The decode_ihdr_chunk function in libavcodec/pngdec.c in FFmpeg before 2.7.2 does not enforce uniqueness of the IHDR (aka image header) chunk in a PNG image, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified…

  • CVE-2015-2986Sep 5, 2015
    Rakuto
    Rktsns2
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in rakuto.net hitSuji (rktSNS2) 0.2.2b allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-2985Sep 5, 2015
    Guide Park
    Bbs X102
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in guide-park.com BBS X102 1.03 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-6276Sep 5, 2015
    Cisco Systems, Inc.
    TelePresence IX5000
    risk 0.00cvss —epss 0.01

    Cisco TelePresence IX5000 8.0.3 stores a private key associated with an X.509 certificate under the web root with insufficient access control, which allows remote attackers to obtain cleartext versions of HTTPS traffic or spoof devices via a direct request to the certificate…

  • CVE-2015-5986Sep 5, 2015
    Isc
    Bind
    risk 0.02cvss —epss 0.26

    openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted DNS response.

  • CVE-2015-5722Sep 5, 2015
    Isc
    Bind
    risk 0.03cvss —epss 0.34

    buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) by creating a zone containing a malformed DNSSEC key and issuing a query for a name in that zone.

  • CVE-2015-2991Sep 5, 2015
    Nscripter Project
    Nscripter
    risk 0.00cvss —epss 0.03

    Buffer overflow in NScripter before 3.00 allows remote attackers to execute arbitrary code via crafted save data.

  • CVE-2015-2990Sep 5, 2015
    NEOJAPAN Inc.
    Desknet Neo
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in zhtml.cgi in NEOJAPAN desknet NEO 2.0R1.0 through 2.5R1.4 allows remote authenticated users to read arbitrary files via a crafted parameter.

  • CVE-2015-6812Sep 4, 2015
    Invision Power Services
    Power Board
    risk 0.00cvss —epss 0.01

    Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.0.12.1 allows remote attackers to cause a denial of service (loop and memory consumption) via a crafted URL.

  • CVE-2015-6811Sep 4, 2015
    Cyberoam
    Cyberoamos
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to login.xml.

  • CVE-2015-6810Sep 4, 2015
    Invision Power Services
    Power Board
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the event_location[address] array parameter to…

  • CVE-2015-6809Sep 4, 2015
    Bedita
    Bedita
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in BEdita before 3.6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cfg[projectName] parameter to index.php/admin/saveConfig, the (2) data[stats_provider_url] parameter to index.php/areas/saveArea,…

  • CVE-2015-6808Sep 4, 2015
    Drupal
    Spotlight
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title.

  • CVE-2015-6807Sep 4, 2015
    Drupal
    Mass Contact
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer mass contact" permission to inject arbitrary web script or HTML via a category label.

  • CVE-2015-5688Sep 4, 2015
    Geddyjs
    Geddy
    risk 0.00cvss —epss 0.09

    Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.

  • CVE-2015-5612Sep 4, 2015
    Octobercms
    October
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.

  • CVE-2014-9605Sep 4, 2015
    Netsweeper
    Netsweeper
    risk 0.03cvss —epss 0.04

    WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and…

  • CVE-2015-6259Sep 4, 2015
    Cisco Systems, Inc.
    Ucs Director
    risk 0.00cvss —epss 0.03

    The JavaServer Pages (JSP) component in Cisco Integrated Management Controller (IMC) Supervisor before 1.0.0.1 and UCS Director (formerly Cloupia Unified Infrastructure Controller) before 5.2.0.1 allows remote attackers to write to arbitrary files via crafted HTTP requests, aka…

  • CVE-2015-4544Sep 4, 2015
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.03

    EMC Documentum Content Server before 7.1P20 and 7.2.x before 7.2P04 does not properly verify authorization for dm_job object access, which allows remote authenticated users to obtain superuser privileges via crafted object operations. NOTE: this vulnerability exists because of…

  • CVE-2015-4538Sep 4, 2015
    EMC Corporation
    Atmos
    risk 0.00cvss —epss 0.03

    The XML parser in EMC Atmos before 2.2.3.426 and 2.3.x before 2.3.1.0 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, related to an XML…

  • CVE-2015-6583Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Google Chrome before 45.0.2454.85 does not display a location bar for a hosted app's window after navigation away from the installation site, which might make it easier for remote attackers to spoof content via a crafted app, related to browser.cc and…

  • CVE-2015-6582Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The decompose function in platform/transforms/TransformationMatrix.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not verify that a matrix inversion succeeded, which allows remote attackers to cause a denial of service (uninitialized memory access and…

  • CVE-2015-6581Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.03

    Double free vulnerability in the opj_j2k_copy_default_tcp_and_create_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 45.0.2454.85, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by…

  • CVE-2015-6580Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Google V8 before 4.5.103.29, as used in Google Chrome before 45.0.2454.85, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

  • CVE-2015-1301Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in Google Chrome before 45.0.2454.85 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

  • CVE-2015-1300Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to…

  • CVE-2015-1299Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the shared-timer implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging erroneous timer firing, related to…

  • CVE-2015-1298Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtime_api.cc in Google Chrome before 45.0.2454.85 does not ensure that the setUninstallURL preference corresponds to the URL of a web site, which allows user-assisted remote attackers to…

  • CVE-2015-1297Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The WebRequest API implementation in extensions/browser/api/web_request/web_request_api.cc in Google Chrome before 45.0.2454.85 does not properly consider a request's source before accepting the request, which allows remote attackers to bypass intended access restrictions via a…

  • CVE-2015-1296Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.01

    The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these…

  • CVE-2015-1295Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Multiple use-after-free vulnerabilities in the PrintWebViewHelper class in components/printing/renderer/print_web_view_helper.cc in Google Chrome before 45.0.2454.85 allow user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact by…

  • CVE-2015-1294Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    Use-after-free vulnerability in the SkMatrix::invertNonIdentity function in core/SkMatrix.cpp in Skia, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering the use of matrix…

  • CVE-2015-1293Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The DOM implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

  • CVE-2015-1292Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker.

  • CVE-2015-1291Sep 3, 2015
    Google
    Chrome
    risk 0.00cvss —epss 0.02

    The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service (DOM tree…

  • CVE-2015-6545Sep 3, 2015
    Webgroupmedia
    Cerb
    risk 0.00cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a saveWorkerPeek action.

  • CVE-2015-4552Sep 3, 2015
    MyBB
    Mybb
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the quick edit function in xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the content of a post.

  • CVE-2015-1516Sep 3, 2015
    Polycom
    Realpresence Cloudaxis Suite
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Polycom RealPresence CloudAXIS Suite before 1.7.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-6654Sep 3, 2015
    Xen
    Xen
    risk 0.00cvss —epss 0.00

    The xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a failure to retrieve a reference on a foreign page, which allows remote domains to cause a denial of service by…

  • CVE-2015-6506Sep 3, 2015
    Bestpractical
    Request Tracker
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the cryptography interface in Request Tracker (RT) before 4.2.12 allows remote attackers to inject arbitrary web script or HTML via a crafted public key.

  • CVE-2015-5737Sep 3, 2015
    Fortinet
    Forticlient
    risk 0.00cvss —epss 0.01

    The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, (4) mdare64_52.sys, and (5) Fortishield.sys drivers in Fortinet FortiClient before 5.2.4 do not properly restrict access to the API for management of processes and the Windows registry, which allows local users to…

  • CVE-2015-5736Sep 3, 2015
    Fortinet
    Forticlient
    risk 0.03cvss —epss 0.02

    The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback function in a (1) 0x220024 or (2) 0x220028 ioctl call.

  • CVE-2015-5735Sep 3, 2015
    Fortinet
    Forticlient
    risk 0.00cvss —epss 0.01

    The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to write to arbitrary memory locations via a 0x226108 ioctl call.

  • CVE-2015-5190Sep 3, 2015
    Pacemaker\/corosync Configuration System Project
    Pacemaker\/corosync Configuration System
    risk 0.00cvss —epss 0.03

    The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.

  • CVE-2015-5189Sep 3, 2015
    Pacemaker\/corosync Configuration System Project
    Pacemaker\/corosync Configuration System
    risk 0.00cvss —epss 0.01

    Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.

  • CVE-2015-4077Sep 3, 2015
    Fortinet
    Forticlient
    risk 0.03cvss —epss 0.01

    The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to read arbitrary kernel memory via a 0x22608C ioctl call.

  • CVE-2015-6277Sep 2, 2015
    Cisco Systems, Inc.
    Mds 9000
    risk 0.00cvss —epss 0.01

    The ARP implementation in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 5.2(1)SV3(1.4), Nexus 3000 devices 7.3(0)ZD(0.47), Nexus 4000 devices 4.1(2)E1, Nexus 9000 devices 7.3(0)ZD(0.61), and MDS 9000 devices 7.0(0)HSK(0.353) and SAN-OS NX-OS on MDS 9000 devices…

  • CVE-2015-6274Sep 2, 2015
    Cisco Systems, Inc.
    ASR 1000
    risk 0.00cvss —epss 0.02

    The IPv4 implementation on Cisco ASR 1000 devices with software 15.5(3)S allows remote attackers to cause a denial of service (ESP QFP CPU consumption) by triggering packet fragmentation and reassembly, aka Bug ID CSCuv71273.

  • CVE-2015-4330Sep 2, 2015
    Cisco Systems, Inc.
    Telepresence Video Communication Server
    risk 0.00cvss —epss 0.01

    A local file script in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges for OS command execution via invalid parameters, aka Bug ID CSCuv10556.

  • CVE-2015-6805Sep 2, 2015
    WordPress
    MDC Private Message
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message.