VYPR

CVEs

395,154 total · page 6515 of 7,904

AllCriticalHighKEV
  • CVE-2015-3988May 19, 2015
    OpenStack
    Horizon
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavor or (3) Host Aggregate.

  • CVE-2015-3885May 19, 2015
    Dcraw Project
    Dcraw
    risk 0.00cvss —epss 0.05

    Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.

  • CVE-2015-3409May 19, 2015
    Module
    Module::Signature
    risk 0.00cvss —epss 0.00

    Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under the current working directory, as demonstrated by a Trojan horse Text::Diff module.

  • CVE-2015-3408May 19, 2015
    Perl Foundation
    Module::Signature
    risk 0.00cvss —epss 0.06

    Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.

  • CVE-2015-3407May 19, 2015
    Module Signature Project
    Module Signature
    risk 0.00cvss —epss 0.02

    Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.

  • CVE-2015-1846May 19, 2015
    Unzoo
    Unzoo
    risk 0.00cvss —epss 0.03

    unzoo allows remote attackers to cause a denial of service (infinite loop and resource consumption) via unspecified vectors to the (1) ExtrArch or (2) ListArch function, related to pointer handling.

  • CVE-2015-1845May 19, 2015
    Unzoo
    Unzoo
    risk 0.00cvss —epss 0.06

    Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2015-0267May 19, 2015
    Red Hat
    Kexec Tools
    risk 0.00cvss —epss 0.00

    The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file.

  • CVE-2015-0739May 19, 2015
    Cisco Systems, Inc.
    Firesight System Software
    risk 0.00cvss —epss 0.02

    The Lights-Out Management (LOM) implementation in Cisco FireSIGHT System Software 5.3.0 on Sourcefire 3D Sensor devices allows remote authenticated users to perform arbitrary Baseboard Management Controller (BMC) file uploads via unspecified vectors, aka Bug ID CSCus87938.

  • CVE-2015-3631May 18, 2015
    Docker
    Docker
    risk 0.00cvss —epss 0.01

    Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.

  • CVE-2015-3630May 18, 2015
    Docker
    Docker
    risk 0.00cvss —epss 0.01

    Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.

  • CVE-2015-3629HigMay 18, 2015
    Docker
    Libcontainer
    risk 0.44cvss 7.8epss 0.01

    Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.

  • CVE-2015-3627May 18, 2015
    Docker
    Docker
    risk 0.00cvss —epss 0.01

    Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.

  • CVE-2015-3455May 18, 2015
    Squid Cache
    Squid
    risk 0.01cvss —epss 0.11

    Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers…

  • CVE-2015-3306CriKEVMay 18, 2015
    Proftpd
    Proftpd
    risk 0.88cvss 10.0epss 0.99

    The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

  • CVE-2015-2704May 18, 2015
    Realmd Project
    Realmd
    risk 0.00cvss —epss 0.03

    realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response.

  • CVE-2015-2667May 18, 2015
    risk 0.00cvss —epss 0.01

    Untrusted search path vulnerability in GNS3 1.2.3 allows local users to gain privileges via a Trojan horse uuid.dll in an unspecified directory.

  • CVE-2015-2346May 18, 2015
    Huawei
    Seq Analyst
    risk 0.00cvss —epss 0.01

    XML external entity (XXE) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter.

  • CVE-2015-1868May 18, 2015
    PowerDNS
    Recursor
    risk 0.07cvss —epss 0.82

    The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a…

  • CVE-2015-0278May 18, 2015
    Libuv Project
    Libuv
    risk 0.00cvss —epss 0.03

    libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.

  • CVE-2014-8384May 18, 2015
    Infocus
    IN3128HD
    risk 0.00cvss —epss 0.03

    The InFocus IN3128HD projector with firmware 0.26 does not restrict access to cgi-bin/webctrl.cgi.elf, which allows remote attackers to modify the DHCP server and device IP configuration, reboot the device, change the device name, and have other unspecified impact via a crafted…

  • CVE-2014-8383May 18, 2015
    Infocus
    IN3128HD
    risk 0.00cvss —epss 0.03

    The InFocus IN3128HD projector with firmware 0.26 allows remote attackers to bypass authentication via a direct request to main.html.

  • CVE-2015-0738May 17, 2015
    Cisco Systems, Inc.
    Web Security Appliance
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Web Tracking Report page on Cisco Web Security Appliance (WSA) devices 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified field, aka Bug ID CSCuu16008.

  • CVE-2015-0735May 17, 2015
    Cisco Systems, Inc.
    Unified Customer Voice Portal
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cisco Unified Customer Voice Portal (CVP) 10.5(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut93970.

  • CVE-2014-9204May 17, 2015
    Rockwellautomation
    Rslinx
    risk 0.00cvss —epss 0.02

    Stack-based buffer overflow in OPCTest.exe in Rockwell Automation RSLinx Classic before 3.73.00 allows remote attackers to execute arbitrary code via a crafted CSV file.

  • CVE-2015-0730May 16, 2015
    Cisco Systems, Inc.
    Wide Area Application Services
    risk 0.00cvss —epss 0.01

    The SMB module in Cisco Wide Area Application Services (WAAS) 6.0(1) allows remote attackers to cause a denial of service (module reload) via an invalid field in a Negotiate Protocol request, aka Bug ID CSCuo75645.

  • CVE-2015-0729May 16, 2015
    Cisco Systems, Inc.
    Secure Access Control Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server Solution Engine (ACSE) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a file-inclusion attack, aka Bug ID CSCuu11005.

  • CVE-2015-0726May 16, 2015
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.03

    The web administration interface on Cisco Wireless LAN Controller (WLC) devices before 7.0.241, 7.1.x through 7.4.x before 7.4.122, and 7.5.x and 7.6.x before 7.6.120 allows remote authenticated users to cause a denial of service (device crash) via unspecified parameters, aka…

  • CVE-2015-0723May 16, 2015
    Cisco Systems, Inc.
    Wireless Lan Controller Software
    risk 0.00cvss —epss 0.01

    The wireless web-authentication subsystem on Cisco Wireless LAN Controller (WLC) devices 7.5.x and 7.6.x before 7.6.120 allows remote attackers to cause a denial of service (process crash and device restart) via a crafted value, aka Bug ID CSCum03269.

  • CVE-2015-0717May 16, 2015
    Cisco Systems, Inc.
    Unified Communications Manager
    risk 0.00cvss —epss 0.00

    Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546.

  • CVE-2015-0736May 16, 2015
    Cisco Systems, Inc.
    Mediasense
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cisco MediaSense 10.5(1) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu16728.

  • CVE-2015-0731May 16, 2015
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.00cvss —epss 0.01

    The ISDN implementation in Cisco IOS 15.3S allows remote attackers to cause a denial of service (device reload) via malformed Q931 SETUP messages, aka Bug ID CSCut37890.

  • CVE-2015-2810May 15, 2015
    Hancom
    Hwp 2014
    risk 0.00cvss —epss 0.02

    Integer overflow in the HwpApp::CHncSDS_Manager function in Hancom Office HanWord processor, as used in Hwp 2014 VP before 9.1.0.2342, HanWord Viewer 2007 and Viewer 2010 8.5.6.1158, and HwpViewer 2014 VP 9.1.0.2186, allows remote attackers to cause a denial of service (crash)…

  • CVE-2015-3989May 15, 2015
    Concrete5
    Concrete5
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.

  • CVE-2015-3325May 15, 2015
    WordPress
    Wp Symposium
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the show parameter in the QUERY_STRING to the default URI.

  • CVE-2015-2250May 15, 2015
    Concrete5
    Concrete5
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) banned_word[] parameter to index.php/dashboard/system/conversations/bannedwords/success, (2) channel parameter to…

  • CVE-2015-0734May 15, 2015
    Cisco Systems, Inc.
    Email Security Appliance Firmware
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Email Security Appliance (ESA) 8.5.6-106 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCut87743.

  • CVE-2015-0728May 15, 2015
    Cisco Systems, Inc.
    Secure Access Control System
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Cisco Access Control Server (ACS) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu11002.

  • CVE-2015-0727May 15, 2015
    Cisco Systems, Inc.
    Security Manager
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the HTTP module in Cisco Security Manager (CSM) 4.7(0)SP1(1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27789.

  • CVE-2015-0724May 15, 2015
    Cisco Systems, Inc.
    Headend Digital Broadband Delivery System
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in dncs 7.0.0.12 in Cisco Headend Digital Broadband Delivery System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCur25604.

  • CVE-2015-0634May 15, 2015
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the administrative interface in Cisco WebEx Meetings Server 2.5 and 2.5.0.997 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuq86310.

  • CVE-2015-3987May 14, 2015
    McAfee
    Epo Deep Command
    risk 0.00cvss —epss 0.00

    Multiple unquoted Windows search path vulnerabilities in the (1) Client Management and (2) Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gain privileges via unspecified vectors.

  • CVE-2015-3986May 14, 2015
    Thecartpress
    Thecartpress Ecommerce Shopping Cart
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct…

  • CVE-2015-3983May 14, 2015
    Clusterlabs
    Pcs
    risk 0.00cvss —epss 0.02

    The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per…

  • CVE-2015-3427May 14, 2015
    Quassel Irc
    Quassel
    risk 0.00cvss —epss 0.02

    Quassel before 0.12.2 does not properly re-initialize the database session when the PostgreSQL database is restarted, which allows remote attackers to conduct SQL injection attacks via a \ (backslash) in a message. NOTE: this vulnerability exists because of an incomplete fix…

  • CVE-2015-3301May 14, 2015
    Thecartpress
    Thecartpress Ecommerce Shopping Cart
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. (dot dot) in the tcp_box_path parameter in the…

  • CVE-2015-3300May 14, 2015
    Thecartpress
    Thecartpress Ecommerce Shopping Cart
    risk 0.04cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the (1) billing_firstname, (2)…

  • CVE-2015-1848May 14, 2015
    Clusterlabs
    Pcs
    risk 0.00cvss —epss 0.02

    The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to…

  • CVE-2015-0971May 14, 2015
    Suricata
    Suricata
    risk 0.00cvss —epss 0.01

    The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates.

  • CVE-2014-8162May 14, 2015
    Red Hat
    Satellite
    risk 0.00cvss —epss 0.03

    XML external entity (XXE) in the RPC interface in Spacewalk and Red Hat Network (RHN) Satellite 5.7 and earlier allows remote attackers to read arbitrary files and possibly have other unspecified impact via unknown vectors.