VYPR

CVEs

396,194 total · page 6500 of 7,924

AllCriticalHighKEV
  • CVE-2015-2907Aug 23, 2015
    Mobile Devices
    C4 Obd Ii Dongle Firmware
    risk 0.00cvss —epss 0.03

    Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password.

  • CVE-2015-2906Aug 23, 2015
    Mobile Devices
    C4 Obd Ii Dongle Firmware
    risk 0.00cvss —epss 0.03

    Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging…

  • CVE-2015-2905Aug 23, 2015
    Actiontec
    GT784WN
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet connectivity of arbitrary users.

  • CVE-2015-2904Aug 23, 2015
    Actiontec
    GT784WN
    risk 0.00cvss —epss 0.01

    Actiontec GT784WN modems with firmware before NCS01-1.0.13 have hardcoded credentials, which makes it easier for remote attackers to obtain root access by connecting to the web administration interface.

  • CVE-2015-2873Aug 23, 2015
    Trend Micro
    Deep Discovery Inspector
    risk 0.00cvss —epss 0.03

    Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensitive information or change the…

  • CVE-2015-2872Aug 23, 2015
    Trend Micro
    Deep Discovery Inspector
    risk 0.00cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to…

  • CVE-2015-2018Aug 23, 2015
    IBM
    Websphere Message Broker
    risk 0.00cvss —epss 0.01

    IBM Integration Bus 9 and 10 before 10.0.0.1 and WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.7 do not ensure that the correct security profile is selected, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

  • CVE-2015-4950Aug 23, 2015
    IBM
    Tivoli Storage Flashcopy Manager
    risk 0.00cvss —epss 0.02

    The mailbox-restore feature in IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 6.1 before 6.1.3.6, 6.3 before 6.3.1.3, 6.4 before 6.4.1.4, and 7.1 before 7.1.0.2; Tivoli Storage FlashCopy Manager: FlashCopy Manager for Microsoft Exchange Server…

  • CVE-2015-1992Aug 23, 2015
    IBM
    Director
    risk 0.00cvss —epss 0.00

    IBM Systems Director 5.2.x, 6.1.x, 6.2.0.x, 6.2.1.x, 6.3.0.0, 6.3.1.x, 6.3.2.x, 6.3.3.x, 6.3.5.0, and 6.3.6.0 improperly processes events, which allows local users to gain privileges via unspecified vectors.

  • CVE-2015-6557Aug 23, 2015
    IBM
    Tivoli Storage Flashcopy Manager
    risk 0.00cvss —epss 0.00

    IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 5.5 before 5.5.1.1, 6.1 before…

  • CVE-2015-4949Aug 23, 2015
    IBM
    Tivoli Storage Flashcopy Manager
    risk 0.00cvss —epss 0.00

    IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 7.1 before 7.1.2, and Tivoli Storage FlashCopy Manager 4.1 before 4.1.2 place cleartext passwords…

  • CVE-2015-2015Aug 23, 2015
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in pubnames.ntf (aka the Directory template) in the web server in IBM Domino before 9.0.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYH8WBPRN.

  • CVE-2015-2014Aug 23, 2015
    IBM
    Lotus Domino
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in the web server in IBM Domino 8.5 before 8.5.3 FP6 IF9 and 9.0 before 9.0.1 FP4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via a crafted URL, aka SPR SJAR9DNGDA.

  • CVE-2015-5408Aug 22, 2015
    Microfocus
    CentralView Revenue Leakage Control
    risk 0.00cvss —epss 0.01

    HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1, 2.2, and 2.3; CentralView Roaming Fraud Control 2.1, 2.2, and 2.3; and…

  • CVE-2015-5407Aug 22, 2015
    Microfocus
    CentralView Revenue Leakage Control
    risk 0.00cvss —epss 0.01

    HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1, 2.2, and 2.3; CentralView Roaming Fraud Control 2.1, 2.2, and 2.3; and…

  • CVE-2015-5406Aug 22, 2015
    Microfocus
    CentralView Revenue Leakage Control
    risk 0.00cvss —epss 0.02

    HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; CentralView Revenue Leakage Control 4.1, 4.2, and 4.3; CentralView Dealer Performance Audit 2.0 and 2.1; CentralView Credit Risk Control 2.1, 2.2, and 2.3; CentralView Roaming Fraud Control 2.1, 2.2, and 2.3; and…

  • CVE-2015-4938Aug 22, 2015
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 allows remote attackers to spoof servlets and obtain sensitive information via unspecified vectors.

  • CVE-2015-2137Aug 22, 2015
    Microfocus
    Operations Manager i
    risk 0.01cvss —epss 0.10

    Unspecified vulnerability in HP Operations Manager i (OMi) 9.22, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote attackers to execute arbitrary code via unknown vectors.

  • CVE-2015-2132Aug 22, 2015
    Microfocus
    Operations Manager i
    risk 0.00cvss —epss 0.00

    Unspecified vulnerability in the execve system-call implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges via unknown vectors.

  • CVE-2015-1932Aug 22, 2015
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header.

  • CVE-2014-1972Aug 22, 2015
    Apache
    Tapestry
    risk 0.00cvss —epss 0.10

    Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.

  • CVE-2015-2983Aug 22, 2015
    Phpkobo
    Photo Gallery CMS Free
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in admin.php in PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone 1.0.1 Free and earlier allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2015-2982Aug 22, 2015
    Phpkobo
    Photo Gallery CMS Free
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in jquery.lightbox-0.5.min.js in PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone 1.0.1 Free and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified input to admin.php.

  • CVE-2015-4537Aug 22, 2015
    EMC Corporation
    Documentum D2
    risk 0.00cvss —epss 0.01

    Lockbox in EMC Documentum D2 before 4.5 uses a hardcoded passphrase when a server lacks a D2.Lockbox file, which makes it easier for remote authenticated users to decrypt admin tickets by locating this passphrase in a decompiled D2 JAR archive.

  • CVE-2015-2984Aug 22, 2015
    I-O DATA
    WN-G54/R2
    risk 0.00cvss —epss 0.02

    I-O DATA DEVICE WN-G54/R2 routers with firmware before 1.03 and NP-BBRS routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.

  • CVE-2015-6258Aug 22, 2015
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.02

    The Internet Access Point Protocol (IAPP) module on Cisco Wireless LAN Controller (WLC) devices with software 8.1(104.37) allows remote attackers to trigger incorrect traffic forwarding via crafted IPv6 packets, aka Bug ID CSCuv40033.

  • CVE-2015-6256Aug 22, 2015
    Cisco Systems, Inc.
    Asr 5000
    risk 0.00cvss —epss 0.01

    Cisco ASR 5000 devices with software 19.0.M0.60828 allow remote attackers to cause a denial of service (OSPF process restart) via crafted length fields in headers of OSPF packets, aka Bug ID CSCuv62820.

  • CVE-2015-4331Aug 22, 2015
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.00cvss —epss 0.02

    Cisco Prime Infrastructure (PI) 1.4(0.45) and earlier, when AAA authentication is used, allows remote authenticated users to bypass intended access restrictions via a username with a modified composition of lowercase and uppercase characters, aka Bug ID CSum59958.

  • CVE-2015-6530Aug 20, 2015
    Opentext
    Secure Mft 2013
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in OpenText Secure MFT 2013 before 2013 R3 P6 and 2014 before 2014 R2 P2 allows remote attackers to inject arbitrary web script or HTML via the querytext parameter to userdashboard.jsp.

  • CVE-2015-6529Aug 20, 2015
    Phpipam
    Phpipam
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in phpipam 1.1.010 allow remote attackers to inject arbitrary web script or HTML via the (1) section parameter to site/error.php or (2) ip parameter to site/tools/searchResults.php.

  • CVE-2015-6528Aug 20, 2015
    Coppermine
    Coppermine Photo Gallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username, (2) admin_password, (3) admin_email, (4) dbserver, (5) dbname, (6)…

  • CVE-2015-3219Aug 20, 2015
    OpenStack
    Horizon
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which…

  • CVE-2015-4318Aug 20, 2015
    Cisco Systems, Inc.
    Telepresence Video Communication Server
    risk 0.00cvss —epss 0.02

    Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528.

  • CVE-2015-4536Aug 20, 2015
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.01

    EMC Documentum Content Server before 7.0 P20, 7.1 before P18, and 7.2 before P02, when RPC tracing is configured, stores certain obfuscated password data in a log file, which allows remote authenticated users to obtain sensitive information by reading this file.

  • CVE-2015-4535Aug 20, 2015
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.02

    Java Method Server (JMS) in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02, when __debug_trace__ is configured, allows remote authenticated users to gain super-user privileges by leveraging the ability to…

  • CVE-2015-4534Aug 20, 2015
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.04

    Java Method Server (JMS) in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 allows remote authenticated users to execute arbitrary code by forging a signature for a query string that lacks the method_verb…

  • CVE-2015-4533Aug 20, 2015
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.04

    EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges…

  • CVE-2015-4532Aug 20, 2015
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.03

    EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with…

  • CVE-2015-4531Aug 20, 2015
    EMC Corporation
    Documentum Content Server
    risk 0.00cvss —epss 0.02

    EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization for subgroups of privileged groups, which allows remote authenticated sysadmins to gain super-user privileges, and bypass…

  • CVE-2015-4530Aug 20, 2015
    EMC Corporation
    Documentum Administrator
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in EMC Documentum WebTop before 6.8P01, Documentum Administrator through 7.2, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote…

  • CVE-2015-4329Aug 20, 2015
    Cisco Systems, Inc.
    Telepresence Video Communication Server
    risk 0.00cvss —epss 0.02

    The administrator web interface in Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, aka Bug ID CSCuv11796.

  • CVE-2015-4321Aug 20, 2015
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.02

    The Unicast Reverse Path Forwarding (uRPF) implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(1.50), 9.3(2.100), 9.3(3), and 9.4(1) mishandles cases where an IP address belongs to an internal interface but is also in the ASA routing table, which allows remote…

  • CVE-2015-4319Aug 20, 2015
    Cisco Systems, Inc.
    Telepresence Video Communication Server
    risk 0.00cvss —epss 0.02

    The password-change feature in the administrative web interface in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 improperly performs authorization, which allows remote authenticated users to reset arbitrary active-user passwords via unspecified vectors,…

  • CVE-2015-4316Aug 20, 2015
    Cisco Systems, Inc.
    Telepresence Video Communication Server
    risk 0.00cvss —epss 0.02

    The Mobile and Remote Access (MRA) endpoint-validation feature in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 improperly validates the phone line used for registration, which allows remote authenticated users to conduct impersonation attacks via a…

  • CVE-2015-4303Aug 20, 2015
    Cisco Systems, Inc.
    Telepresence Video Communication Server
    risk 0.00cvss —epss 0.02

    Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary commands in the context of the nobody user account via an unspecified web-page parameter, aka Bug ID CSCuv12333.

  • CVE-2015-0542Aug 20, 2015
    EMC Corporation
    Rsa Archer Egrc
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in EMC RSA Archer GRC 5.5 SP1 before P3 allow remote attackers to hijack the authentication of arbitrary users.

  • CVE-2015-0537CriAug 20, 2015
    Dell
    Bsafe
    risk 0.64cvss 9.8epss 0.03

    Integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-C Micro Edition (Crypto-C ME) before 4.0.4 and 4.1, and RSA BSAFE SSL-C 2.8.9 and earlier allows remote attackers to…

  • CVE-2015-0536HigAug 20, 2015
    Dell
    Bsafe
    risk 0.49cvss 7.5epss 0.02

    EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allow remote attackers to cause a denial of service (daemon crash) via a…

  • CVE-2015-0535HigAug 20, 2015
    Dell
    Bsafe
    risk 0.49cvss 7.5epss 0.01

    EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier do not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via…

  • CVE-2015-0534HigAug 20, 2015
    Dell
    Bsafe
    risk 0.49cvss 7.5epss 0.01

    EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2, RSA BSAFE SSL-J before 6.2, and RSA BSAFE SSL-C 2.8.9 and earlier do not enforce certain constraints on certificate data, which allows remote attackers to defeat a…