VYPR

CVEs

37,811 total · page 711 of 757

AllCriticalHighKEV
  • CVE-2017-12932CriAug 18, 2017
    PHP
    PHP
    risk 0.64cvss 9.8epss 0.07

    ext/standard/var_unserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this…

  • CVE-2017-12910CriAug 17, 2017
    Nexusphp Project
    Nexusphp
    risk 0.64cvss 9.8epss 0.01

    SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the or parameter.

  • CVE-2017-12909CriAug 17, 2017
    Nexusphp Project
    Nexusphp
    risk 0.64cvss 9.8epss 0.01

    SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter.

  • CVE-2017-12908CriAug 17, 2017
    Nexusphp Project
    Nexusphp
    risk 0.64cvss 9.8epss 0.01

    SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr parameter.

  • CVE-2017-7555CriAug 17, 2017
    Augeas
    Augeas
    risk 0.64cvss 9.8epss 0.05

    Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. Attacker could send crafted strings that would cause the application using augeas to copy past the end of a buffer, leading to a crash or possible…

  • CVE-2011-0469CriAug 17, 2017
    OpenSUSE
    Build service
    risk 0.57cvss 9.8epss 0.02

    Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011.

  • CVE-2017-7551CriAug 16, 2017
    Fedoraproject
    389 Directory Server
    risk 0.64cvss 9.8epss 0.01

    389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.

  • CVE-2017-7546CriAug 16, 2017
    PostgreSQL
    PostgreSQL
    risk 0.69cvss 9.8epss 0.62

    PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

  • CVE-2017-8248CriAug 16, 2017
    Apple Inc.
    Iphone OS
    risk 0.64cvss 9.8epss 0.03

    A buffer overflow may occur in the processing of a downlink NAS message in Qualcomm Telephony as used in Apple iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation.

  • CVE-2017-9653CriAug 14, 2017
    Osisoft
    Pi Integrator For Microsoft Azure
    risk 0.64cvss 9.8epss 0.02

    An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker is able to gain privileged access to the system while…

  • CVE-2017-9800CriAug 11, 2017
    Apache
    Subversion
    risk 0.65cvss 9.8epss 0.19

    A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server…

  • CVE-2015-3616CriAug 11, 2017
    Fortinet
    Fortimanager
    risk 0.64cvss 9.8epss 0.02

    SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecified parameters.

  • CVE-2017-3124CriAug 11, 2017
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.08

    Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the picture exchange (PCX) file format parsing module. Successful exploitation could lead to…

  • CVE-2017-3108CriAug 11, 2017
    Adobe Inc.
    Experience Manager
    risk 0.64cvss 9.8epss 0.09

    Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability.

  • CVE-2017-11274CriAug 11, 2017
    Adobe Inc.
    Digital Editions
    risk 0.64cvss 9.8epss 0.09

    Adobe Digital Editions 4.5.4 and earlier has an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

  • CVE-2017-8658CriAug 11, 2017
    Microsoft
    Chakracore
    risk 0.58cvss 9.8epss 0.20

    A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".

  • CVE-2016-5018CriAug 10, 2017
    Apache
    Tomcat
    risk 0.53cvss 9.1epss 0.10

    In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

  • CVE-2017-12774CriAug 9, 2017
    Finecms Project
    Finecms
    risk 0.64cvss 9.8epss 0.02

    finecms in 1.9.5\controllers\member\ContentController.php allows remote attackers to operate website database

  • CVE-2017-12762CriAug 9, 2017
    Linux
    Kernel
    risk 0.64cvss 9.8epss 0.05

    In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree.

  • CVE-2015-6816CriAug 9, 2017
    Ganglia
    Web
    risk 0.57cvss 9.8epss 0.04

    ganglia-web before 3.7.1 allows remote attackers to bypass authentication.

  • CVE-2015-2311CriAug 9, 2017
    Sandstorm Io
    Sandstorm
    risk 0.57cvss 9.8epss 0.03

    Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.

  • CVE-2015-2310CriAug 9, 2017
    Sandstorm Io
    Sandstorm
    risk 0.52cvss 9.1epss 0.02

    Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.

  • CVE-2015-1820CriAug 9, 2017
    Rest Client Project
    REST Client
    risk 0.64cvss 9.8epss 0.04

    REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.

  • CVE-2015-0786CriAug 9, 2017
    Novell
    Zenworks Configuration Management
    risk 0.66cvss 9.8epss 0.24

    Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2015-0782CriAug 9, 2017
    Novell
    Zenworks Configuration Management
    risk 0.64cvss 9.8epss 0.07

    SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2015-0781CriAug 9, 2017
    Novell
    Zenworks Configuration Management
    risk 0.64cvss 9.8epss 0.04

    Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to upload and execute arbitrary files via unspecified vectors.

  • CVE-2015-0780CriAug 9, 2017
    Novell
    Zenworks Configuration Management
    risk 0.64cvss 9.8epss 0.08

    SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2012-2781CriAug 9, 2017
    FFmpeg
    Ffmpeg
    risk 0.64cvss 9.8epss 0.02

    Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-2778, and CVE-2012-2780.

  • CVE-2012-2780CriAug 9, 2017
    FFmpeg
    Ffmpeg
    risk 0.64cvss 9.8epss 0.02

    Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-2778, and CVE-2012-2781.

  • CVE-2012-2778CriAug 9, 2017
    FFmpeg
    Ffmpeg
    risk 0.64cvss 9.8epss 0.02

    Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-2780, and CVE-2012-2781.

  • CVE-2012-2773CriAug 9, 2017
    FFmpeg
    Ffmpeg
    risk 0.64cvss 9.8epss 0.02

    Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2778, CVE-2012-2780, and CVE-2012-2781.

  • CVE-2012-2771CriAug 9, 2017
    FFmpeg
    Ffmpeg
    risk 0.64cvss 9.8epss 0.02

    Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2773, CVE-2012-2778, CVE-2012-2780, and CVE-2012-2781.

  • CVE-2015-6941CriAug 9, 2017
    Saltstack
    Salt 2015
    risk 0.57cvss 9.8epss 0.02

    win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs.

  • CVE-2012-0803CriAug 8, 2017
    Apache
    Cxf
    risk 0.64cvss 9.8epss 0.04

    The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request.

  • CVE-2010-3845CriAug 8, 2017
    Apache Authenhook Project
    Apache Authenhook
    risk 0.64cvss 9.8epss 0.02

    libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log.

  • CVE-2017-3632CriAug 8, 2017
    Oracle Corporation
    Solaris
    risk 0.64cvss 9.8epss 0.04

    Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: CDE Calendar). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Solaris.…

  • CVE-2017-11153CriAug 8, 2017
    Synology
    Photo Station
    risk 0.68cvss 9.8epss 0.12

    Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload.

  • CVE-2017-11151CriAug 8, 2017
    Synology
    Photo Station
    risk 0.68cvss 9.8epss 0.16

    A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logo_upload action.

  • CVE-2017-10202CriAug 8, 2017
    Oracle Corporation
    Database Server
    risk 0.65cvss 9.9epss 0.02

    Vulnerability in the OJVM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2 and 12.2.0.1. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via…

  • CVE-2017-10137CriAug 8, 2017
    Oracle Corporation
    Weblogic Server
    risk 0.65cvss 10.0epss 0.04

    Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: JNDI). Supported versions that are affected are 10.3.6.0 and 12.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise…

  • CVE-2017-10111CriAug 8, 2017
    NetApp
    Steelstore Cloud Integrated Storage
    risk 0.63cvss 9.6epss 0.02

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). The supported version that is affected is Java SE: 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via…

  • CVE-2017-10110CriAug 8, 2017
    NetApp
    Steelstore Cloud Integrated Storage
    risk 0.63cvss 9.6epss 0.02

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java…

  • CVE-2017-10107CriAug 8, 2017
    NetApp
    Steelstore Cloud Integrated Storage
    risk 0.63cvss 9.6epss 0.03

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access…

  • CVE-2017-10102CriAug 8, 2017
    NetApp
    Steelstore Cloud Integrated Storage
    risk 0.59cvss 9.0epss 0.03

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Difficult to exploit vulnerability allows unauthenticated attacker with network…

  • CVE-2017-10101CriAug 8, 2017
    NetApp
    Steelstore Cloud Integrated Storage
    risk 0.63cvss 9.6epss 0.03

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network…

  • CVE-2017-10096CriAug 8, 2017
    NetApp
    Steelstore Cloud Integrated Storage
    risk 0.63cvss 9.6epss 0.03

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network…

  • CVE-2017-10090CriAug 8, 2017
    NetApp
    Steelstore Cloud Integrated Storage
    risk 0.63cvss 9.6epss 0.03

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access…

  • CVE-2017-10089CriAug 8, 2017
    NetApp
    Steelstore Cloud Integrated Storage
    risk 0.63cvss 9.6epss 0.02

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise…

  • CVE-2017-10087CriAug 8, 2017
    NetApp
    Steelstore Cloud Integrated Storage
    risk 0.63cvss 9.6epss 0.03

    Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network…

  • CVE-2017-10086CriAug 8, 2017
    NetApp
    Steelstore Cloud Integrated Storage
    risk 0.63cvss 9.6epss 0.02

    Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u141 and 8u131. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE.…