VYPR

CVEs

396,198 total · page 6499 of 7,924

AllCriticalHighKEV
  • CVE-2015-5949Aug 25, 2015
    VideoLAN
    VLC media player
    risk 0.01cvss —epss 0.13

    VideoLAN VLC media player 2.2.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted 3GP file, which triggers the freeing of arbitrary pointers.

  • CVE-2015-5161Aug 25, 2015
    Zend
    Framework
    risk 0.00cvss —epss 0.10

    The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML…

  • CVE-2015-4020Aug 25, 2015
    RubyGems
    Rubygems
    risk 0.00cvss —epss 0.03

    RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed…

  • CVE-2012-2150Aug 25, 2015
    Xfsprogs
    xfsprogs
    risk 0.00cvss —epss 0.04

    xfs_metadump in xfsprogs before 3.2.4 does not properly obfuscate file data, which allows remote attackers to obtain sensitive information by reading a generated image.

  • CVE-2015-6262Aug 25, 2015
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cisco Prime Infrastructure 1.2(0.103) and 2.0(0.0) allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCum49054 and CSCum49059.

  • CVE-2015-5786Aug 25, 2015
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.03

    Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5785.

  • CVE-2015-5785Aug 25, 2015
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.03

    Apple QuickTime before 7.7.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-5786.

  • CVE-2015-3269Aug 25, 2015
    Apache
    Flex Blazeds
    risk 0.01cvss —epss 0.10

    Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an…

  • CVE-2015-6249Aug 24, 2015
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.7 does not prevent the conflicting use of a table for both IPv4 and IPv6 addresses, which allows remote attackers to cause a denial of service…

  • CVE-2015-6248Aug 24, 2015
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The ptvcursor_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

  • CVE-2015-6247Aug 24, 2015
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_openflow_tablemod_v5 function in epan/dissectors/packet-openflow_v5.c in the OpenFlow dissector in Wireshark 1.12.x before 1.12.7 does not validate a certain offset value, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

  • CVE-2015-6246Aug 24, 2015
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_wa_payload function in epan/dissectors/packet-waveagent.c in the WaveAgent dissector in Wireshark 1.12.x before 1.12.7 mishandles large tag values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.

  • CVE-2015-6245Aug 24, 2015
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    epan/dissectors/packet-gsm_rlcmac.c in the GSM RLC/MAC dissector in Wireshark 1.12.x before 1.12.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

  • CVE-2015-6244Aug 24, 2015
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissect_zbee_secure function in epan/dissectors/packet-zbee-security.c in the ZigBee dissector in Wireshark 1.12.x before 1.12.7 improperly relies on length fields contained in packet data, which allows remote attackers to cause a denial of service (application crash) via a…

  • CVE-2015-6243Aug 24, 2015
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table searches for empty strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the (1) dissector_get_string_handle…

  • CVE-2015-6242Aug 24, 2015
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The wmem_block_split_free_chunk function in epan/wmem/wmem_allocator_block.c in the wmem block allocator in the memory manager in Wireshark 1.12.x before 1.12.7 does not properly consider a certain case of multiple realloc operations that restore a memory chunk to its original…

  • CVE-2015-6241Aug 24, 2015
    Wireshark
    Wireshark
    risk 0.00cvss —epss 0.03

    The proto_tree_add_bytes_item function in epan/proto.c in the protocol-tree implementation in Wireshark 1.12.x before 1.12.7 does not properly terminate a data structure after a failure to locate a number within a string, which allows remote attackers to cause a denial of…

  • CVE-2015-5424Aug 24, 2015
    Microfocus
    Keyview
    risk 0.01cvss —epss 0.11

    Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2885.

  • CVE-2015-5423Aug 24, 2015
    Microfocus
    Keyview
    risk 0.01cvss —epss 0.11

    Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2884.

  • CVE-2015-5422Aug 24, 2015
    Microfocus
    Keyview
    risk 0.01cvss —epss 0.11

    Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2883.

  • CVE-2015-5421Aug 24, 2015
    Microfocus
    Keyview
    risk 0.01cvss —epss 0.11

    Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2881.

  • CVE-2015-5420Aug 24, 2015
    Microfocus
    Keyview
    risk 0.01cvss —epss 0.11

    Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2880.

  • CVE-2015-5419Aug 24, 2015
    Microfocus
    Keyview
    risk 0.01cvss —epss 0.11

    Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2879.

  • CVE-2015-5418Aug 24, 2015
    Microfocus
    Keyview
    risk 0.01cvss —epss 0.11

    Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2877.

  • CVE-2015-5417Aug 24, 2015
    Microfocus
    Keyview
    risk 0.01cvss —epss 0.11

    Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2876.

  • CVE-2015-5416Aug 24, 2015
    Microfocus
    Keyview
    risk 0.01cvss —epss 0.11

    Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2875.

  • CVE-2014-9744Aug 24, 2015
    Polarssl
    Polarssl
    risk 0.00cvss —epss 0.02

    Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientHello messages. NOTE: this identifier was SPLIT from CVE-2014-8628 per ADT3 due to different affected versions.

  • CVE-2014-8987Aug 24, 2015
    Mantisbt
    Mantisbt
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the config_option parameter, a different…

  • CVE-2014-8628Aug 24, 2015
    Polarssl
    Polarssl
    risk 0.00cvss —epss 0.02

    Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates. NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See…

  • CVE-2015-6665Aug 24, 2015
    Drupal
    Drupal
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to…

  • CVE-2015-6664Aug 24, 2015
    SAP
    Mobile Platform
    risk 0.00cvss —epss 0.02

    XML external entity (XXE) vulnerability in the application import functionality in SAP Mobile Platform 2.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2152227.

  • CVE-2015-6663Aug 24, 2015
    SAP
    Afaria
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject arbitrary web script or HTML via crafted client name data, aka SAP Security Note 2152669.

  • CVE-2015-6662Aug 24, 2015
    SAP
    Netweaver
    risk 0.00cvss —epss 0.02

    XML external entity (XXE) vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2168485.

  • CVE-2015-6661Aug 24, 2015
    Drupal
    Drupal
    risk 0.00cvss —epss 0.03

    Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.

  • CVE-2015-6660Aug 24, 2015
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."

  • CVE-2015-6659Aug 24, 2015
    Drupal
    Drupal
    risk 0.00cvss —epss 0.03

    SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.

  • CVE-2015-6658Aug 24, 2015
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.

  • CVE-2015-6525Aug 24, 2015
    Libevent Project
    Libevent
    risk 0.00cvss —epss 0.05

    Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2)…

  • CVE-2015-6524Aug 24, 2015
    Apache
    Activemq
    risk 0.00cvss —epss 0.09

    The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was…

  • CVE-2015-6496Aug 24, 2015
    Netfilter
    Conntrack Tools
    risk 0.00cvss —epss 0.03

    conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a (1) DCCP, (2) SCTP, or (3) ICMPv6 packet.

  • CVE-2015-6251Aug 24, 2015
    GNU
    Gnutls
    risk 0.02cvss —epss 0.19

    Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.

  • CVE-2015-5964Aug 24, 2015
    Djangoproject
    Django
    risk 0.00cvss —epss 0.05

    The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial…

  • CVE-2015-5963Aug 24, 2015
    Djangoproject
    Django
    risk 0.00cvss —epss 0.05

    contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of…

  • CVE-2015-5222Aug 24, 2015
    Red Hat
    Openshift
    risk 0.00cvss —epss 0.03

    Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.

  • CVE-2015-5058Aug 24, 2015
    F5, Inc.
    Big IP
    risk 0.00cvss —epss 0.02

    Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.5.x before 11.5.1 HF10, 11.5.3 before HF1, and 11.6.0 before HF5, BIG-IQ Cloud, Device, and Security 4.4.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows…

  • CVE-2015-3238MedAug 24, 2015
    Linux Pam
    Linux Pam
    risk 0.42cvss 6.5epss 0.03

    The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, allows local users to enumerate usernames or cause a denial of service (hang) via a large password.

  • CVE-2015-0298Aug 24, 2015
    Red Hat
    Mod Cluster
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message.

  • CVE-2014-6272Aug 24, 2015
    Libevent Project
    Libevent
    risk 0.00cvss —epss 0.02

    Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1)…

  • CVE-2014-3612Aug 24, 2015
    Apache
    Activemq
    risk 0.00cvss —epss 0.07

    The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.…

  • CVE-2015-5566Aug 24, 2015
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.07

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via…