VYPR

CVEs

396,155 total · page 6510 of 7,924

AllCriticalHighKEV
  • CVE-2015-5611Jul 21, 2015
    Fca
    Uconnect
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Uconnect before 15.26.1, as used in certain Fiat Chrysler Automobiles (FCA) from 2013 to 2015 models, allows remote attackers in the same cellular network to control vehicle movement, cause human harm or physical damage, or modify dashboard settings…

  • CVE-2015-4554Jul 21, 2015
    TIBCO Software
    Spotfire Professional
    risk 0.00cvss —epss 0.03

    Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client in Spotfire Analyst before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Analytics Platform for AWS 6.5 and 7.0.x before 7.0.1; Spotfire Automation…

  • CVE-2015-2134Jul 21, 2015
    Microfocus
    System Management Homepage
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.5.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2015-1906Jul 21, 2015
    IBM
    Business Process Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to inject arbitrary web script…

  • CVE-2015-1905Jul 21, 2015
    IBM
    Business Process Manager
    risk 0.00cvss —epss 0.01

    The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via…

  • CVE-2015-5610Jul 21, 2015
    SolarWinds
    N Able N Central
    risk 0.00cvss —epss 0.02

    The RSM (aka RSMWinService) service in SolarWinds N-Able N-Central before 9.5.1.4514 uses the same password decryption key across different customers' installations, which makes it easier for remote authenticated users to obtain the cleartext domain-administrator password by…

  • CVE-2015-2869Jul 21, 2015
    Ghisler
    Total Commander
    risk 0.00cvss —epss 0.04

    The FileInfo plugin before 2.22 for Ghisler Total Commander allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via (1) a large Size value in the Archive Member Header of a COFF Archive Library file, (2) a large Number Of Symbols value…

  • CVE-2015-4283Jul 21, 2015
    Cisco Systems, Inc.
    Videoscape Policy Resource Manager
    risk 0.00cvss —epss 0.01

    Cisco Videoscape Policy Resource Manager (PRM) 3.5.4 allows remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood, aka Bug IDs CSCuu35104 and CSCuu35128.

  • CVE-2015-5124Jul 20, 2015
    Adobe Inc.
    Air
    risk 0.01cvss —epss 0.07

    Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary…

  • CVE-2015-4279Jul 20, 2015
    Cisco Systems, Inc.
    Unified Computing System
    risk 0.00cvss —epss 0.00

    The Manager component in Cisco Unified Computing System (UCS) 2.2(3b) on B Blade Server devices allows local users to gain privileges for executing arbitrary CLI commands by leveraging access to the subordinate fabric interconnect, aka Bug ID CSCut32778.

  • CVE-2015-3185Jul 20, 2015
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.16

    The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended…

  • CVE-2015-3183Jul 20, 2015
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.73

    The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid…

  • CVE-2015-2863Jul 20, 2015
    Kaseya
    Virtual System Administrator
    risk 0.04cvss —epss 0.10

    Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2015-2862Jul 20, 2015
    Kaseya
    Virtual System Administrator
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request.

  • CVE-2015-0253Jul 20, 2015
    Apache
    HTTP Server
    risk 0.00cvss —epss 0.13

    The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a…

  • CVE-2015-2426HigKEVJul 20, 2015
    Microsoft
    Windows
    risk 0.79cvss 8.8epss 0.87

    Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute…

  • CVE-2015-2418Jul 20, 2015
    Microsoft
    Malicious Software Removal Tool
    risk 0.00cvss —epss 0.01

    Race condition in Microsoft Malicious Software Removal Tool (MSRT) before 5.26 allows local users to gain privileges via a crafted DLL, aka "MSRT Race Condition Vulnerability."

  • CVE-2015-4111Jul 20, 2015
    Blackberry
    Link
    risk 0.00cvss —epss 0.04

    mc_demux_mp4_ds.ax in an unspecified third-party codec demux in BlackBerry Link before 1.2.3.53 with installer before 1.1.0.22 allows remote attackers to execute arbitrary code via a crafted MP4 file.

  • CVE-2015-1984Jul 20, 2015
    IBM
    Infosphere Master Data Management
    risk 0.00cvss —epss 0.01

    IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to bypass intended access restrictions and read arbitrary profiles via unspecified vectors, as demonstrated by discovering usernames for use…

  • CVE-2015-1982Jul 20, 2015
    IBM
    Infosphere Master Data Management
    risk 0.00cvss —epss 0.01

    IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to obtain sensitive information via a crafted request, which reveals the full path in an error message.

  • CVE-2015-1980Jul 20, 2015
    IBM
    Infosphere Master Data Management
    risk 0.00cvss —epss 0.01

    IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.

  • CVE-2015-1979Jul 20, 2015
    IBM
    Case Manager
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Error dialog in IBM Case Manager 5.2.1 before 5.2.1.2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to the (1) addressability or (2) comments component.

  • CVE-2015-1968Jul 20, 2015
    IBM
    Infosphere Master Data Management
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2015-1935Jul 20, 2015
    IBM
    Db2
    risk 0.00cvss —epss 0.04

    The scalar-function implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors.

  • CVE-2015-1922Jul 20, 2015
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    The Data Movement implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to bypass intended access restrictions and delete table rows via unspecified vectors.

  • CVE-2015-1883Jul 20, 2015
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read certain administrative files via crafted use of an automated-maintenance policy stored procedure.

  • CVE-2015-0157Jul 20, 2015
    IBM
    Db2
    risk 0.00cvss —epss 0.03

    IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service (daemon crash) by leveraging an unspecified scalar function in a SQL statement.

  • CVE-2015-0130Jul 20, 2015
    IBM
    Rational Quality Manager
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Quality Manager (RQM) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Team…

  • CVE-2014-9196Jul 20, 2015
    Eaton
    Proview
    risk 0.00cvss —epss 0.03

    Eaton Cooper Power Systems ProView 4.0 and 5.0 before 5.0 11 on Form 6 controls and Idea and IdeaPLUS relays generates TCP initial sequence number (ISN) values linearly, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.

  • CVE-2014-8910Jul 20, 2015
    IBM
    Db2
    risk 0.00cvss —epss 0.02

    IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary text files via a crafted XML/XSLT function in a SELECT statement.

  • CVE-2015-2972Jul 19, 2015
    Sysphonic
    Thetis
    risk 0.00cvss —epss 0.03

    Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2015-2971Jul 19, 2015
    Seeds
    Acmailer
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in Seeds acmailer before 3.8.18 and 3.9.x before 3.9.12 Beta allows remote authenticated users to delete arbitrary files via a crafted string.

  • CVE-2015-5374Jul 18, 2015
    Siemens Foundation
    EN100 Ethernet module
    risk 0.09cvss —epss 0.74

    A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03;…

  • CVE-2015-4458Jul 18, 2015
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.00cvss —epss 0.01

    The TLS implementation in the Cavium cryptographic-module firmware, as distributed with Cisco Adaptive Security Appliance (ASA) Software 9.1(5.21) and other products, does not verify the MAC field, which allows man-in-the-middle attackers to spoof TLS content by modifying…

  • CVE-2015-4280Jul 18, 2015
    Cisco Systems, Inc.
    Prime Collaboration
    risk 0.00cvss —epss 0.02

    Cisco Prime Collaboration Assurance 10.0 allows remote attackers to cause a denial of service (HTTP service outage) via a crafted HTTP request, aka Bug ID CSCum38844.

  • CVE-2015-0795Jul 18, 2015
    Microfocus
    Security Solutions for iSeries
    risk 0.00cvss —epss 0.04

    Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1 allow remote attackers to execute arbitrary code via long arguments, aka ZDI-CAN-2699.

  • CVE-2015-3625Jul 18, 2015
    Nvidia
    GPU Driver
    risk 0.00cvss —epss 0.00

    The NVIDIA GPU driver for FreeBSD R352 before 352.09, 346 before 346.72, R349 before 349.16, R343 before 343.36, R340 before 340.76, R337 before 337.25, R334 before 334.21, R331 before 331.113, and R304 before 304.125 allows local users with certain permissions to read or write…

  • CVE-2015-4529Jul 16, 2015
    EMC Corporation
    Documentum Administrator
    risk 0.00cvss —epss 0.02

    Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to redirect…

  • CVE-2015-4528Jul 16, 2015
    EMC Corporation
    Documentum Centerstage
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in EMC Documentum CenterStage 1.2SP1 and 1.2SP2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2015-0725Jul 16, 2015
    Cisco Systems, Inc.
    Videoscape Distribution Suite Service Broker
    risk 0.00cvss —epss 0.02

    Cisco Videoscape Distribution Suite Service Broker (aka VDS-SB), when a VDSM configuration on UCS is used, and Videoscape Distribution Suite for Internet Streaming (aka VDS-IS or CDS-IS) before 3.3.1 R7 and 4.x before 4.0.0 R4 allow remote attackers to cause a denial of service…

  • CVE-2015-4460Jul 16, 2015
    B.A.S
    C2Box
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in SecuritySetting/UserSecurity/UserManagement.aspx in B.A.S C2Box before 4.0.0 (r19171) allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via certain vectors.

  • CVE-2015-5386Jul 16, 2015
    Siemens Foundation
    SICAM MIC
    risk 0.00cvss —epss 0.03

    Siemens SICAM MIC devices with firmware before 2404 allow remote attackers to bypass authentication and obtain administrative access via unspecified HTTP requests.

  • CVE-2015-4278Jul 16, 2015
    Cisco Systems, Inc.
    Email Security Appliance Firmware
    risk 0.00cvss —epss 0.02

    Cisco Email Security Appliance (ESA) devices with software 8.5.6-106 and 9.5.0-201 allow remote attackers to cause a denial of service (per-domain e-mail reception outage) by placing malformed DMARC policy data in DNS TXT records for a domain, aka Bug ID CSCuv14806.

  • CVE-2015-4276Jul 16, 2015
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.03

    Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138.

  • CVE-2015-4275Jul 16, 2015
    Cisco Systems, Inc.
    Asr 5000
    risk 0.00cvss —epss 0.02

    The Packet Data Network Gateway (aka PGW) component on Cisco ASR 5000 devices with software 18.0.0.59167 and 18.0.0.59211 allows remote attackers to cause a denial of service via a malformed header in a GTPv2 packet, aka Bug ID CSCut11534.

  • CVE-2015-4274Jul 16, 2015
    Cisco Systems, Inc.
    Unified Intelligence Center
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Unified Intelligence Center 10.0(1) and 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuu94862 and CSCuu97936.

  • CVE-2015-4266Jul 16, 2015
    Cisco Systems, Inc.
    Identity Services Engine Software
    risk 0.00cvss —epss 0.01

    The web interface in Cisco Identity Services Engine (ISE) 1.1(4.1), 1.3(106.146), and 1.3(120.135) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site,…

  • CVE-2015-5530Jul 16, 2015
    Freereprintables
    Articlefr
    risk 0.03cvss —epss 0.02

    Multiple cross-site request forgery (CSRF) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request to dashboard/users/create/.

  • CVE-2015-5529Jul 16, 2015
    Freereprintables
    Articlefr
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to dashboard/settings/categories/, (2) title or (3) rel parameter to dashboard/settings/links/, or…

  • CVE-2015-5528Jul 16, 2015
    WordPress
    Floating Social Bar
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the save_order function in class-floating-social-bar.php in the Floating Social Bar plugin before 1.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the items[] parameter in an fsb_save_order action…