VYPR

CVEs

38,009 total · page 727 of 761

AllCriticalHighKEV
  • CVE-2016-4558HigMay 23, 2016
    Linux
    Kernel
    risk 0.49cvss 7.0epss 0.01

    The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted application on (1) a system with more than 32 Gb of memory, related to…

  • CVE-2016-4557HigMay 23, 2016
    Linux
    Kernel
    risk 0.55cvss 7.8epss 0.10

    The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure, which allows local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions that…

  • CVE-2016-4485HigMay 23, 2016
    Linux
    Kernel
    risk 0.49cvss 7.5epss 0.05

    The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message.

  • CVE-2016-2157HigMay 22, 2016
    Moodle
    Moodle
    risk 0.50cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests…

  • CVE-2016-4343HigMay 22, 2016
    PHP
    PHP
    risk 0.58cvss 8.8epss 0.04

    The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact…

  • CVE-2016-4342HigMay 22, 2016
    PHP
    PHP
    risk 0.58cvss 8.8epss 0.05

    ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) TAR,…

  • CVE-2016-2222HigMay 22, 2016
    WordPress
    WordPress
    risk 0.57cvss 8.6epss 0.09

    The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.

  • CVE-2016-2221HigMay 22, 2016
    WordPress
    WordPress
    risk 0.41cvss 7.4epss 0.05

    Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as…

  • CVE-2015-8879HigMay 22, 2016
    PHP
    PHP
    risk 0.49cvss 7.5epss 0.03

    The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array…

  • CVE-2015-8877HigMay 22, 2016
    PHP
    PHP
    risk 0.42cvss 7.5epss 0.04

    The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted…

  • CVE-2015-8867HigMay 22, 2016
    PHP
    PHP
    risk 0.49cvss 7.5epss 0.04

    The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection…

  • CVE-2016-1402HigMay 21, 2016
    Cisco Systems, Inc.
    Identity Services Engine Software
    risk 0.49cvss 7.5epss 0.02

    The Active Directory (AD) integration component in Cisco Identity Service Engine (ISE) before 1.2.0.899 patch 7, when AD group-membership authorization is enabled, allows remote attackers to cause a denial of service (authentication outage) via a crafted Password Authentication…

  • CVE-2016-4348HigMay 20, 2016
    GNOME Foundation
    Librsvg
    risk 0.49cvss 7.5epss 0.02

    The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document.

  • CVE-2016-3728HigMay 20, 2016
    Theforeman
    Foreman
    risk 0.57cvss 8.8epss 0.03

    Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/.

  • CVE-2016-3693HigMay 20, 2016
    Safemode Project
    Safemode
    risk 0.46cvss 8.1epss 0.02

    The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.

  • CVE-2015-7558HigMay 20, 2016
    GNOME Foundation
    Librsvg
    risk 0.49cvss 7.5epss 0.02

    librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document.

  • CVE-2015-7557HigMay 20, 2016
    GNOME Foundation
    Librsvg
    risk 0.49cvss 7.5epss 0.02

    The _rsvg_node_poly_build_path function in rsvg-shapes.c in librsvg before 2.40.7 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via an odd number of elements in a coordinate pair in an SVG document.

  • CVE-2016-4070HigMay 20, 2016
    PHP
    PHP
    risk 0.49cvss 7.5epss 0.06

    Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor…

  • CVE-2016-1859HigMay 20, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.03

    The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2016-1857HigMay 20, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.03

    WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and…

  • CVE-2016-1856HigMay 20, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.03

    WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and…

  • CVE-2016-1855HigMay 20, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1856, and…

  • CVE-2016-1854HigMay 20, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.03

    WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1855, CVE-2016-1856, and…

  • CVE-2016-1853HigMay 20, 2016
    Apple Inc.
    OS X
    risk 0.49cvss 7.5epss 0.03

    Tcl in Apple OS X before 10.11.5 allows remote attackers to obtain sensitive information by leveraging SSLv2 support.

  • CVE-2016-1850HigMay 20, 2016
    Apple Inc.
    SceneKit
    risk 0.51cvss 7.8epss 0.02

    SceneKit in Apple OS X before 10.11.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file.

  • CVE-2016-1848HigMay 20, 2016
    Apple Inc.
    Quicktime
    risk 0.54cvss 7.8epss 0.05

    QuickTime in Apple OS X before 10.11.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file.

  • CVE-2016-1847HigMay 20, 2016
    Apple Inc.
    tvOS
    risk 0.57cvss 8.8epss 0.02

    OpenGL, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2016-1846HigMay 20, 2016
    Nvidia
    Graphics Driver
    risk 0.54cvss 7.8epss 0.05

    The nvCommandQueue::GetHandleIndex method in the NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference and memory corruption) via a crafted app.

  • CVE-2016-1843HigMay 20, 2016
    Apple Inc.
    OS X
    risk 0.49cvss 7.5epss 0.03

    The Messages component in Apple OS X before 10.11.5 mishandles filename encoding, which allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2016-1842HigMay 20, 2016
    Apple Inc.
    watchOS
    risk 0.49cvss 7.5epss 0.02

    MapKit in Apple iOS before 9.3.2, OS X before 10.11.5, and watchOS before 2.2.1 does not use HTTPS for shared links, which allows remote attackers to obtain sensitive information by sniffing the network for HTTP traffic.

  • CVE-2016-1841HigMay 20, 2016
    Apple Inc.
    tvOS
    risk 0.57cvss 8.8epss 0.02

    libxslt, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2016-1840HigMay 20, 2016
    Xmlsoft
    Libxml2
    risk 0.44cvss 7.8epss 0.03

    Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory…

  • CVE-2016-1835HigMay 20, 2016
    Apple Inc.
    iOS
    risk 0.58cvss 8.8epss 0.05

    Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document.

  • CVE-2016-1834HigMay 20, 2016
    Xmlsoft
    Libxml2
    risk 0.44cvss 7.8epss 0.05

    Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)…

  • CVE-2016-1832HigMay 20, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.00

    libc in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.

  • CVE-2016-1831HigMay 20, 2016
    Apple Inc.
    iOS
    risk 0.51cvss 7.8epss 0.01

    The kernel in Apple iOS before 9.3.2 and OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-1830HigMay 20, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.01

    The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than…

  • CVE-2016-1829HigMay 20, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.02

    The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than…

  • CVE-2016-1828HigMay 20, 2016
    Apple Inc.
    tvOS
    risk 0.54cvss 7.8epss 0.06

    The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than…

  • CVE-2016-1827HigMay 20, 2016
    Apple Inc.
    tvOS
    risk 0.54cvss 7.8epss 0.06

    The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than…

  • CVE-2016-1826HigMay 20, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.02

    Integer overflow in the dtrace implementation in the kernel in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app.

  • CVE-2016-1825HigMay 20, 2016
    Apple Inc.
    OS X
    risk 0.54cvss 7.8epss 0.06

    IOHIDFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-1824HigMay 20, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.02

    IOHIDFamily in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than…

  • CVE-2016-1823HigMay 20, 2016
    Apple Inc.
    tvOS
    risk 0.54cvss 7.8epss 0.05

    The IOHIDDevice::handleReportWithTime function in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (out-of-bounds read and memory corruption)…

  • CVE-2016-1822HigMay 20, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.01

    IOFireWireFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-1821HigMay 20, 2016
    Apple Inc.
    OS X
    risk 0.54cvss 7.8epss 0.05

    IOAudioFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

  • CVE-2016-1820HigMay 20, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.02

    Buffer overflow in IOAudioFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app.

  • CVE-2016-1819HigMay 20, 2016
    Apple Inc.
    tvOS
    risk 0.54cvss 7.8epss 0.05

    Use-after-free vulnerability in the IOAccelContext2::clientMemoryForType method in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory…

  • CVE-2016-1818HigMay 20, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.02

    IOAcceleratorFamily in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than…

  • CVE-2016-1817HigMay 20, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.02

    IOAcceleratorFamily in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than…