VYPR

CVEs

396,193 total · page 6502 of 7,924

AllCriticalHighKEV
  • CVE-2015-5493Aug 18, 2015
    Drupal
    Entityform Block
    risk 0.00cvss —epss 0.01

    The Entityform Block module 7.x-1.x before 7.x-1.3 for Drupal does not properly check permissions when a form is locked to a role, which allows remote attackers to obtain access to certain entityforms via unspecified vectors.

  • CVE-2015-5492Aug 18, 2015
    Drupal
    Video Consultation
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Video Consultation module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-5491Aug 18, 2015
    Drupal
    Dynamic display block
    risk 0.00cvss —epss 0.01

    The Dynamic display block module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users to bypass intended access restrictions and read sensitive titles by leveraging the "administer ddblock" permission.

  • CVE-2015-5490Aug 18, 2015
    Drupal
    Views
    risk 0.00cvss —epss 0.03

    The _views_fetch_data method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via…

  • CVE-2015-5489Aug 18, 2015
    Drupal
    Smart Trim
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors involving the field settings form.

  • CVE-2015-5488Aug 18, 2015
    Drupal
    MailChimp
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the MailChimp Signup submodule in the MailChimp module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "administer mailchimp" permission to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-5487Aug 18, 2015
    Drupal
    Camtasia Relay
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Camtasia Relay module 6.x-2.x before 6.x-3.2 and 7.x-2.x before 7.x-1.3 for Drupal allows remote authenticated users with the "view meta information" permission to inject arbitrary web script or HTML via unspecified vectors related…

  • CVE-2015-5482Aug 18, 2015
    WordPress
    Gd Bbpress Attachments
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.

  • CVE-2015-5481Aug 18, 2015
    WordPress
    Gd Bbpress Attachments
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpress_attachments page to wp-admin/edit.php.

  • CVE-2015-4670Aug 18, 2015
    Devexpress
    Ajax Control Toolkit
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in the AjaxFileUpload control in DevExpress AJAX Control Toolkit (aka AjaxControlToolkit) before 15.1 allows remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to AjaxFileUploadHandler.axd.

  • CVE-2015-4426Aug 18, 2015
    Pimcore
    Pimcore
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.

  • CVE-2015-4425Aug 18, 2015
    Pimcore
    Pimcore
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.

  • CVE-2015-6516Aug 18, 2015
    Cygnux
    Syspass
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in cygnux.org sysPass 1.0.9 and earlier allows remote authenticated users to execute arbitrary SQL commands via the search parameter to ajax/ajax_search.php.

  • CVE-2015-6515Aug 18, 2015
    Splunk
    Splunk
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.4, 6.1.x before 6.1.8, 6.0.x before 6.0.9, and 5.0.x before 5.0.13 and Splunk Light 6.2.x before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via a header.

  • CVE-2015-6514Aug 18, 2015
    Splunk
    Splunk
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Dashboard in Splunk Enterprise 6.2.x before 6.2.4 and Splunk Light 6.2.x before 6.2.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-6513Aug 18, 2015
    WordPress
    J2store
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the J2Store (com_j2store) extension before 3.1.7 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) sortby or (2) manufacturer_ids[] parameter to index.php.

  • CVE-2015-6512Aug 18, 2015
    Freichat
    Freichat
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in the get_messages function in server/plugins/chatroom/chatroom.php in FreiChat 9.6 allows remote attackers to execute arbitrary SQL commands via the time parameter to server/freichat.php.

  • CVE-2015-6511Aug 18, 2015
    Pfsense
    Pfsense
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the server[] parameter to services_ntpd.php.

  • CVE-2015-6510Aug 18, 2015
    Pfsense
    Pfsense
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) srctrack, (2) use_mfs_tmp_size, or (3) use_mfs_var_size parameter to system_advanced_misc.php; the (4) port, (5) snaplen, or (6)…

  • CVE-2015-6509Aug 18, 2015
    Pfsense
    Pfsense
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php; (2) adaptiveend, (3) adaptivestart, (4) maximumstates, (5) maximumtableentries,…

  • CVE-2015-6508Aug 18, 2015
    Pfsense
    Pfsense
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the descr parameter in a "new" action to system_authservers.php.

  • CVE-2015-5681Aug 18, 2015
    WordPress
    Powerplay Gallery
    risk 0.00cvss —epss 0.05

    Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in *_uploadfolder/big/.

  • CVE-2015-5599Aug 18, 2015
    WordPress
    Powerplay Gallery
    risk 0.00cvss —epss 0.03

    Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.

  • CVE-2015-5485Aug 18, 2015
    WordPress
    Eventbrite Tickets
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Event Import page (import-eventbrite-events.php) in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "error" parameter to…

  • CVE-2015-4029Aug 18, 2015
    Pfsense
    WebGUI
    risk 0.02cvss —epss 0.20

    Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the zone parameter in a del action to services_captiveportal_zones.php.

  • CVE-2015-6254Aug 17, 2015
    Picketlink
    Picketlink
    risk 0.00cvss —epss 0.02

    The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have…

  • CVE-2015-0277Aug 17, 2015
    Picketlink
    Picketlink
    risk 0.00cvss —epss 0.02

    The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has…

  • CVE-2015-5531Aug 17, 2015
    Elastic
    Elasticsearch
    risk 0.11cvss —epss 0.95

    Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

  • CVE-2014-9743Aug 17, 2015
    VideoLAN
    VLC media player
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the httpd_HtmlError function in network/httpd.c in the web interface in VideoLAN VLC Media Player before 2.2.0 allows remote attackers to inject arbitrary web script or HTML via the path info.

  • CVE-2015-5784Aug 17, 2015
    Apple Inc.
    Install Framework Legacy
    risk 0.04cvss —epss 0.09

    runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 does not properly drop privileges, which allows attackers to execute arbitrary code in a privileged context via a crafted app.

  • CVE-2015-5783Aug 17, 2015
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.03

    IOGraphics in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3770.

  • CVE-2015-5782Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.

  • CVE-2015-5781Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information from process memory via a crafted PNG image.

  • CVE-2015-5779Aug 17, 2015
    Apple Inc.
    Quicktime
    risk 0.00cvss —epss 0.04

    QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789,…

  • CVE-2015-5778Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.03

    CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-5777.

  • CVE-2015-5777Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.03

    CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-5778.

  • CVE-2015-5776Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.04

    Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by leveraging use of an AF_INET6 socket.

  • CVE-2015-5775Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.04

    FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-3804 and CVE-2015-5756.

  • CVE-2015-5774Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.00

    Buffer overflow in IOHIDFamily in Apple iOS before 8.4.1 and OS X before 10.10.5 allows local users to gain privileges via unspecified vectors.

  • CVE-2015-5773Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.03

    QL Office in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted office document.

  • CVE-2015-5772Aug 17, 2015
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.03

    Heap-based buffer overflow in SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code via a crafted Collada file.

  • CVE-2015-5771Aug 17, 2015
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.03

    Quartz Composer Framework in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted QuickTime file.

  • CVE-2015-5770Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.01

    MobileInstallation in Apple iOS before 8.4.1 does not ensure the uniqueness of universal provisioning profile bundle IDs, which allows attackers to replace arbitrary extensions via a crafted enterprise app.

  • CVE-2015-5769Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    The MSVDX driver in Apple iOS before 8.4.1 allows remote attackers to cause a denial of service (device crash) via a crafted video.

  • CVE-2015-5768Aug 17, 2015
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.01

    AppleGraphicsControl in Apple OS X before 10.10.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.

  • CVE-2015-5766Aug 17, 2015
    Apple Inc.
    Air Traffic
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Air Traffic in Apple iOS before 8.4.1 allows attackers to access arbitrary filesystem locations via vectors related to asset handling.

  • CVE-2015-5763Aug 17, 2015
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.00

    ntfs in Apple OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2015-5761Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.03

    CoreText in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-5755.

  • CVE-2015-5759Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.02

    WebKit in Apple iOS before 8.4.1 allows remote attackers to spoof clicks via a crafted web site that leverages tap events.

  • CVE-2015-5758Aug 17, 2015
    Apple Inc.
    iOS
    risk 0.00cvss —epss 0.03

    ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted TIFF image.