VYPR

CVEs

396,198 total · page 6497 of 7,924

AllCriticalHighKEV
  • CVE-2015-3308Sep 2, 2015
    GNU
    Gnutls
    risk 0.00cvss —epss 0.04

    Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.

  • CVE-2015-6587Sep 2, 2015
    Openafs
    Openafs
    risk 0.00cvss —epss 0.02

    The vlserver in OpenAFS before 1.6.13 allows remote authenticated users to cause a denial of service (out-of-bounds read and crash) via a crafted regular expression in a VL_ListAttributesN2 RPC.

  • CVE-2015-6737Sep 1, 2015
    MediaWiki
    Widgets
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Widgets extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors involving base64 encoded content.

  • CVE-2015-6736Sep 1, 2015
    MediaWiki
    Quiz
    risk 0.00cvss —epss 0.03

    The Quiz extension for MediaWiki allows remote attackers to cause a denial of service via regex metacharacters in a regular expression.

  • CVE-2015-6735Sep 1, 2015
    MediaWiki
    TimedMediaHandler
    risk 0.00cvss —epss 0.03

    The reset functionality in the TimedMediaHandler extension for MediaWiki does not create a new transcode, which allows remote attackers to cause a denial of service (transcode deletion) by resetting a transcode.

  • CVE-2015-6734Sep 1, 2015
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in contrib/cssgen.php in the GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to inject arbitrary web script or HTML via…

  • CVE-2015-6733Sep 1, 2015
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.03

    GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.

  • CVE-2015-6732Sep 1, 2015
    MediaWiki
    SemanticForms
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) wpSummary parameter to Special:FormEdit, the (2) "Template label (optional)" field in a form, or a (3) Field…

  • CVE-2015-6731Sep 1, 2015
    MediaWiki
    SemanticForms
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via a (1) section_*, (2) template_*, (3) label_*, or (4) new_template parameter to Special:CreateForm or (5) target or…

  • CVE-2015-6730Sep 1, 2015
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to…

  • CVE-2015-6729Sep 1, 2015
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the rel404 parameter, which is not properly handled in an error page.

  • CVE-2015-6728Sep 1, 2015
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.01

    The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.

  • CVE-2015-6727Sep 1, 2015
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.

  • CVE-2015-6520Sep 1, 2015
    Ippusbxd Project
    Ippusbxd
    risk 0.00cvss —epss 0.02

    IPPUSBXD before 1.22 listens on all interfaces, which allows remote attackers to obtain access to USB connected printers via a direct request.

  • CVE-2015-2807Sep 1, 2015
    Documentcloud
    Navis Documentcloud
    risk 0.01cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.

  • CVE-2013-7444Sep 1, 2015
    MediaWiki
    Mediawiki
    risk 0.00cvss —epss 0.02

    The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.

  • CVE-2015-6526Aug 31, 2015
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The perf_callchain_user_64 function in arch/powerpc/perf/callchain.c in the Linux kernel before 4.0.2 on ppc64 platforms allows local users to cause a denial of service (infinite loop) via a deep 64-bit userspace backtrace.

  • CVE-2015-6272Aug 31, 2015
    Cisco Systems, Inc.
    iOS Xe
    risk 0.00cvss —epss 0.02

    Cisco IOS XE 2.1.0 through 2.2.3 and 2.3.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted H.323 packet, aka Bug ID CSCsx35393, CSCsx07094, and CSCsw93064.

  • CVE-2015-6271Aug 31, 2015
    Cisco Systems, Inc.
    iOS Xe
    risk 0.00cvss —epss 0.02

    Cisco IOS XE 2.1.0 through 2.4.3 and 2.5.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted SIP packet, aka Bug IDs CSCta74749 and CSCta77008.

  • CVE-2015-6270Aug 31, 2015
    Cisco Systems, Inc.
    iOS Xe
    risk 0.00cvss —epss 0.02

    Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted IPv6 packet, aka Bug ID CSCsv98555.

  • CVE-2015-6269Aug 31, 2015
    Cisco Systems, Inc.
    iOS Xe
    risk 0.00cvss —epss 0.02

    Cisco IOS XE before 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted (1) IPv4 or (2) IPv6 packet, aka Bug ID CSCsw69990.

  • CVE-2015-4036Aug 31, 2015
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. …

  • CVE-2015-2135Aug 31, 2015
    Microfocus
    Intelligent Provisioning
    risk 0.01cvss —epss 0.09

    Unspecified vulnerability in HP Intelligent Provisioning 1.00 through 1.62(a), 2.00, and 2.10 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2015-6754Aug 31, 2015
    Drupal
    Path Breadcrumbs
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "Administer Path Breadcrumbs" permission to inject arbitrary web script or HTML via unspecified…

  • CVE-2015-6753Aug 31, 2015
    Drupal
    Quick Edit
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) entity title, related to in-place editing, or a (2) node…

  • CVE-2015-6655Aug 31, 2015
    Pligg
    CMS
    risk 0.03cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in Pligg CMS 2.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via a request to admin/admin_users.php.

  • CVE-2015-6752Aug 31, 2015
    Drupal
    Search API Autocomplete
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or…

  • CVE-2015-6751Aug 31, 2015
    Drupal
    Time Tracker
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Time Tracker module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a (1) note added to a time entry or an (2) activity used to…

  • CVE-2015-6535Aug 31, 2015
    WordPress
    Youtube Embed
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field (youtube_embed_name parameter).

  • CVE-2014-6616Aug 31, 2015
    Softx
    FG-100 PB PROFIBUS firmware
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Softing FG-100 PROFIBUS Single Channel (FG-100-PB) with firmware FG-x00-PB_V2.02.0.00 allows remote attackers to inject arbitrary web script or HTML via the DEVICE_NAME parameter to cgi-bin/CFGhttp/.

  • CVE-2014-3148Aug 31, 2015
    Okcupid
    OKWS
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in libahttp/err.c in OkCupid OKWS (OK Web Server) allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to a non-existent page, which is not properly handled in a 404 error page.

  • CVE-2014-2570Aug 31, 2015
    PHP Font Lib Project
    PHP Font Lib
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in www/make_subset.php in PHP Font Lib before 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.

  • CVE-2014-2332Aug 31, 2015
    Check Mk Project
    Check Mk
    risk 0.00cvss —epss 0.01

    Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allows remote authenticated users to delete arbitrary files via a request to an unspecified link, related to "Insecure Direct Object References." NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.

  • CVE-2014-2331Aug 31, 2015
    Check Mk Project
    Check Mk
    risk 0.00cvss —epss 0.02

    Check_MK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330.

  • CVE-2014-2330Aug 31, 2015
    Check MK
    Multisite GUI
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Multisite GUI in Check_MK before 1.2.5i2 allow remote attackers to hijack the authentication of users for requests that (1) upload arbitrary snapshots, (2) delete arbitrary files, or possibly have other…

  • CVE-2014-2329Aug 31, 2015
    Check Mk Project
    Check Mk
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in Check_MK before 1.2.2p3 and 1.2.3x before 1.2.3i5 allow remote authenticated users to inject arbitrary web script or HTML via the (1) agent string for a check_mk agent, a (2) crafted request to a monitored host, which is not…

  • CVE-2015-6750Aug 31, 2015
    Ricoh
    Dl 1 Sr10
    risk 0.04cvss —epss 0.08

    Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long USER command.

  • CVE-2015-6747Aug 31, 2015
    Basware
    Banking
    risk 0.00cvss —epss 0.01

    Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability…

  • CVE-2015-6746Aug 31, 2015
    Basware
    Banking
    risk 0.00cvss —epss 0.01

    Basware Banking (Maksuliikenne) before 8.90.07.X stores private keys in plaintext in the SQL database, which allows remote attackers to spoof communications with banks via unspecified vectors. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different…

  • CVE-2015-6745Aug 31, 2015
    Basware
    Banking
    risk 0.00cvss —epss 0.00

    Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to…

  • CVE-2015-6744Aug 31, 2015
    Basware
    Banking
    risk 0.00cvss —epss 0.01

    Basware Banking (Maksuliikenne) before 8.90.07.X relies on the client to enforce (1) login verification, (2) audit trail creation, and (3) account locking, which allows remote attackers to "disrupt security-critical functions" by "dropping network traffic." NOTE: this identifier…

  • CVE-2015-6743Aug 31, 2015
    Basware
    Banking
    risk 0.00cvss —epss 0.01

    Basware Banking (Maksuliikenne) 8.90.07.X uses a hardcoded password for an unspecified account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2…

  • CVE-2015-6742Aug 31, 2015
    Basware
    Banking
    risk 0.00cvss —epss 0.01

    Basware Banking (Maksuliikenne) before 8.90.07.X uses a hardcoded password for the ANCO account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2…

  • CVE-2015-0943Aug 31, 2015
    Basware
    Banking
    risk 0.00cvss —epss 0.01

    Basware Banking (Maksuliikenne) before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user credentials, and other sensitive information by sniffing the network or modify this…

  • CVE-2015-5717Aug 31, 2015
    Siemens Foundation
    Compas
    risk 0.00cvss —epss 0.01

    The Siemens COMPAS Mobile application before 1.6 for Android does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2015-5706Aug 31, 2015
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup…

  • CVE-2015-5697Aug 31, 2015
    Linux
    Kernel
    risk 0.00cvss —epss 0.00

    The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.

  • CVE-2015-5366Aug 31, 2015
    Linux
    Kernel
    risk 0.00cvss —epss 0.06

    The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allows remote attackers to cause a denial of service (EPOLLET epoll application read outage) via an incorrect checksum in a UDP packet, a…

  • CVE-2015-5364Aug 31, 2015
    Linux
    Kernel
    risk 0.00cvss —epss 0.06

    The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.

  • CVE-2015-5157Aug 31, 2015
    Linux
    Kernel
    risk 0.00cvss —epss 0.01

    arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI.