VYPR

CVEs

35,153 total · page 690 of 704

AllCriticalHighKEV
  • CVE-2016-1416CriJul 2, 2016
    Cisco Systems, Inc.
    Prime Collaboration Provisioning
    risk 0.64cvss 9.8epss 0.05

    Cisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP authentication, which allows remote attackers to obtain administrator privileges via a crafted login attempt, aka Bug ID CSCuv37513.

  • CVE-2016-1289CriJul 2, 2016
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.64cvss 9.8epss 0.06

    The API in Cisco Prime Infrastructure 1.2 through 3.0 and Evolved Programmable Network Manager (EPNM) 1.2 allows remote attackers to execute arbitrary code or obtain sensitive management information via a crafted HTTP request, as demonstrated by discovering managed-device…

  • CVE-2016-0391CriJul 2, 2016
    IBM
    Watson Developer Cloud
    risk 0.64cvss 9.8epss 0.01

    The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

  • CVE-2016-3645CriJun 30, 2016
    Symantec
    Norton Antivirus
    risk 0.69cvss 9.8epss 0.25

    Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec…

  • CVE-2016-2141CriJun 30, 2016
    Red Hat
    JGroups
    risk 0.57cvss 9.8epss 0.05

    It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to…

  • CVE-2016-0224CriJun 28, 2016
    IBM
    Marketing Platform
    risk 0.64cvss 9.8epss 0.01

    SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before 9.1.2.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2015-7988CriJun 26, 2016
    Apple Inc.
    Mdnsresponder
    risk 0.64cvss 9.8epss 0.05

    The handle_regservice_request function in mDNSResponder before 625.41.2 allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via unspecified vectors.

  • CVE-2015-7987CriJun 26, 2016
    Apple Inc.
    Mdnsresponder
    risk 0.64cvss 9.8epss 0.03

    Multiple buffer overflows in mDNSResponder before 625.41.2 allow remote attackers to read or write to out-of-bounds memory locations via vectors involving the (1) GetValueForIPv4Addr, (2) GetValueForMACAddr, (3) rfc3110_import, or (4) CopyNSEC3ResourceRecord function.

  • CVE-2016-4519CriJun 25, 2016
    Unitronics
    Visilogic Oplc Ide
    risk 0.64cvss 9.8epss 0.04

    Stack-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.30 allows remote attackers to execute arbitrary code via a crafted filename field in a ZIP archive in a vlp file.

  • CVE-2016-2362CriJun 20, 2016
    Fonality
    Fonality
    risk 0.64cvss 9.8epss 0.02

    Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, which allows remote attackers to obtain access via a (1) FTP or (2) SSH connection.

  • CVE-2016-2177CriJun 20, 2016
    OpenSSL Project
    OpenSSL
    risk 0.60cvss 9.8epss 0.45

    OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc…

  • CVE-2016-0912CriJun 19, 2016
    Dell
    Emc Data Domain OS
    risk 0.64cvss 9.8epss 0.03

    EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 allows remote authenticated users to bypass intended password-change restrictions by leveraging access to (1) a different account with the same role as a target account or (2) an account's session at an unattended workstation.

  • CVE-2016-4819CriJun 19, 2016
    Takumi Yamada
    DX Library
    risk 0.64cvss 9.8epss 0.04

    The printfDx function in Takumi Yamada DX Library for Borland C++ 3.13f through 3.16b, DX Library for Gnu C++ 3.13f through 3.16b, and DX Library for Visual C++ 3.13f through 3.16b allows remote attackers to execute arbitrary code via a crafted string.

  • CVE-2016-1395CriJun 19, 2016
    Cisco Systems, Inc.
    Rv110w
    risk 0.64cvss 9.8epss 0.05

    The web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with firmware before 1.3.0.8 allows remote attackers to execute arbitrary code as root via a crafted HTTP request, aka Bug ID…

  • CVE-2016-3642CriJun 17, 2016
    SolarWinds
    Virtualization Manager
    risk 0.65cvss 9.8epss 0.13

    The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

  • CVE-2015-8914CriJun 17, 2016
    OpenStack
    Neutron
    risk 0.59cvss 9.1epss 0.04

    The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a link-local source address.

  • CVE-2016-4171CriKEVJun 16, 2016
    Adobe Inc.
    Flashplayer
    risk 0.77cvss 9.8epss 0.20

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

  • CVE-2016-4167CriJun 16, 2016
    Adobe Inc.
    Dng Software Development Kit
    risk 0.64cvss 9.8epss 0.05

    Adobe DNG Software Development Kit (SDK) before 1.4 2016 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2016-4165CriJun 16, 2016
    Adobe Inc.
    Brackets
    risk 0.64cvss 9.8epss 0.04

    The extension manager in Adobe Brackets before 1.7 allows attackers to have an unspecified impact via invalid input.

  • CVE-2016-4163CriJun 16, 2016
    Adobe Inc.
    Air SDK
    risk 0.64cvss 9.8epss 0.06

    Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-4162CriJun 16, 2016
    Adobe Inc.
    Air SDK
    risk 0.64cvss 9.8epss 0.06

    Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-4161CriJun 16, 2016
    Adobe Inc.
    Air SDK
    risk 0.64cvss 9.8epss 0.06

    Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-4160CriJun 16, 2016
    Adobe Inc.
    Air SDK
    risk 0.64cvss 9.8epss 0.06

    Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-4138CriJun 16, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.69cvss 9.8epss 0.25

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

  • CVE-2016-4121CriJun 16, 2016
    Adobe Inc.
    Air SDK
    risk 0.65cvss 9.8epss 0.10

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1097,…

  • CVE-2016-4120CriJun 16, 2016
    Adobe Inc.
    Air SDK
    risk 0.64cvss 9.8epss 0.06

    Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-3236CriJun 16, 2016
    Microsoft
    Windows
    risk 0.73cvss 9.8epss 0.77

    The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles proxy discovery, which allows…

  • CVE-2016-3227CriJun 16, 2016
    Microsoft
    Windows Server 2012
    risk 0.66cvss 9.8epss 0.25

    Use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests, aka "Windows DNS Server Use After Free Vulnerability."

  • CVE-2016-5365CriJun 14, 2016
    Huawei
    Honor WS851
    risk 0.64cvss 9.8epss 0.02

    Stack-based buffer overflow in Huawei Honor WS851 routers with software 1.1.21.1 and earlier allows remote attackers to execute arbitrary commands with root privileges via unspecified vectors, aka HWPSIRT-2016-05051.

  • CVE-2015-8869CriJun 13, 2016
    Ocaml
    Ocaml
    risk 0.53cvss 9.1epss 0.05

    OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.

  • CVE-2016-5302CriJun 13, 2016
    Citrix Systems
    Xenserver
    risk 0.64cvss 9.8epss 0.03

    Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow remote attackers on the management network to "compromise" a host by leveraging credentials for an Active Directory account.

  • CVE-2016-2496CriJun 13, 2016
    Google
    Android
    risk 0.64cvss 9.8epss 0.01

    The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct tapjacking attacks and access arbitrary private-storage files by creating a partially overlapping window, aka internal bug 26677796.

  • CVE-2016-2473CriJun 13, 2016
    Google
    Android
    risk 0.64cvss 9.8epss 0.01

    The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27777501.

  • CVE-2016-5118CriJun 10, 2016
    ImageMagick
    Imagemagick
    risk 0.61cvss 9.8epss 0.50

    The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.

  • CVE-2016-3720CriJun 10, 2016
    Fasterxml
    jackson-dataformat-xml
    risk 0.64cvss 9.8epss 0.03

    XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.

  • CVE-2016-2786CriJun 10, 2016
    Puppet (software)
    Puppet Enterprise
    risk 0.64cvss 9.8epss 0.02

    The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.

  • CVE-2016-2785CriJun 10, 2016
    Puppet (software)
    Puppet
    risk 0.57cvss 9.8epss 0.03

    Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

  • CVE-2016-4328CriJun 10, 2016
    Medhost
    Perioperative Information Management System
    risk 0.64cvss 9.8epss 0.04

    MEDHOST Perioperative Information Management System (aka PIMS or VPIMS) before 2015R1 has hardcoded credentials, which makes it easier for remote attackers to obtain sensitive information via direct requests to the application database server.

  • CVE-2016-4326CriJun 10, 2016
    Chef
    Chef Manage
    risk 0.64cvss 9.8epss 0.04

    The Chef Manage (formerly opscode-manage) add-on before 1.12.0 for Chef allows remote attackers to execute arbitrary code via crafted serialized data in a cookie.

  • CVE-2016-0916CriJun 10, 2016
    EMC Corporation
    Networker
    risk 0.64cvss 9.8epss 0.08

    EMC NetWorker 8.2.1.x and 8.2.2.x before 8.2.2.6 and 9.x before 9.0.0.6 mishandles authentication, which allows remote attackers to execute arbitrary commands by leveraging access to a different NetWorker instance.

  • CVE-2016-4448CriJun 9, 2016
    Xmlsoft
    Libxml2
    risk 0.64cvss 9.8epss 0.07

    Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

  • CVE-2016-0749CriJun 9, 2016
    Spice Project
    Spice
    risk 0.64cvss 9.8epss 0.08

    The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.

  • CVE-2016-4532CriJun 9, 2016
    Trihedral
    Vtscada
    risk 0.61cvss 9.1epss 0.28

    Directory traversal vulnerability in the WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to read arbitrary files via a crafted pathname.

  • CVE-2016-4510CriJun 9, 2016
    Trihedral
    Vtscada
    risk 0.61cvss 9.1epss 0.20

    The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and read arbitrary files via unspecified vectors.

  • CVE-2016-2310CriJun 9, 2016
    General Electric (GE)
    Multilink
    risk 0.64cvss 9.8epss 0.03

    General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, which allows remote attackers to modify configuration settings via the web…

  • CVE-2016-5108CriJun 8, 2016
    VideoLAN
    VLC media player
    risk 0.69cvss 9.8epss 0.25

    Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.

  • CVE-2016-4368CriJun 8, 2016
    HPE
    Universal CMDB
    risk 0.64cvss 9.8epss 0.05

    HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC)…

  • CVE-2016-4366CriJun 8, 2016
    HPE
    Systems Insight Manager
    risk 0.64cvss 9.8epss 0.04

    HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.

  • CVE-2016-4360CriJun 8, 2016
    HPE
    LoadRunner
    risk 0.60cvss 9.1epss 0.09

    web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through…

  • CVE-2016-4359CriJun 8, 2016
    HPE
    LoadRunner
    risk 0.65cvss 9.8epss 0.16

    Stack-based buffer overflow in mchan.dll in the agent in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch…