VYPR

CVEs

396,181 total · page 6504 of 7,924

AllCriticalHighKEV
  • CVE-2015-3755Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL.

  • CVE-2015-3754Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.

  • CVE-2015-3753Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image…

  • CVE-2015-3752Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain…

  • CVE-2015-3751Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to bypass a Content Security Policy protection mechanism by using a video control in conjunction with an IMG element within an…

  • CVE-2015-3750Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows…

  • CVE-2015-3749Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3748Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3747Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3746Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3745Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3744Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3743Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3742Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3741Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3740Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3739Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3738Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3737Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3736Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3735Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3734Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3733Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3732Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3731Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3730Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.03

    WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability…

  • CVE-2015-3729Aug 16, 2015
    Apple Inc.
    Safari
    risk 0.00cvss —epss 0.02

    Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.

  • CVE-2013-7422Aug 16, 2015
    Perl Foundation
    Perl
    risk 0.00cvss —epss 0.03

    Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid…

  • CVE-2015-4496Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538.

  • CVE-2015-4493Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a…

  • CVE-2015-4492Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    Use-after-free vulnerability in the XMLHttpRequest::Open implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 might allow remote attackers to execute arbitrary code via a SharedWorker object that makes recursive calls to the open method of an…

  • CVE-2015-4491Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.08

    Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or…

  • CVE-2015-4490Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it…

  • CVE-2015-4489Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The nsTArray_Impl class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging a self assignment.

  • CVE-2015-4488Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    Use-after-free vulnerability in the StyleAnimationValue class in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 allows remote attackers to have an unspecified impact by leveraging a StyleAnimationValue::operator self assignment.

  • CVE-2015-4487Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The nsTSubstring::ReplacePrep function in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, related to…

  • CVE-2015-4486Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    The decrease_ref_count function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via malformed WebM video data.

  • CVE-2015-4485Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in the resize_context_buffers function in libvpx in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via malformed WebM video data.

  • CVE-2015-4484Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.04

    The js::jit::AssemblerX86Shared::lock_addl function in the JavaScript implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to cause a denial of service (application crash) by leveraging the use of shared memory and accessing (1)…

  • CVE-2015-4483Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.02

    Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request.

  • CVE-2015-4482Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.00

    mar_read.c in the Updater in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows local users to gain privileges or cause a denial of service (out-of-bounds write) via a crafted name of a Mozilla Archive (aka MAR) file.

  • CVE-2015-4481Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.03cvss —epss 0.01

    Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.

  • CVE-2015-4480Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.06

    Integer overflow in the stagefright::SampleTable::isValid function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via crafted MPEG-4 video data with H.264 encoding.

  • CVE-2015-4479Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.09

    Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data.

  • CVE-2015-4478Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.03

    Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 do not impose certain ECMAScript 6 requirements on JavaScript object properties, which allows remote attackers to bypass the Same Origin Policy via the reviver parameter to the JSON.parse method.

  • CVE-2015-4477Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.06

    Use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API.

  • CVE-2015-4475Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.00cvss —epss 0.05

    The mozilla::AudioSink function in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 mishandles inconsistent sample formats within MP3 audio data, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a malformed…

  • CVE-2015-4474Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.06

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2015-4473Aug 16, 2015
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2015-2481Aug 15, 2015
    Microsoft
    .net Framework
    risk 0.01cvss —epss 0.14

    The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a crafted .NET application, aka "RyuJIT Optimization Elevation of Privilege Vulnerability," a different…