VYPR

CVEs

38,009 total · page 736 of 761

AllCriticalHighKEV
  • CVE-2016-2171HigApr 11, 2016
    Apache
    Jetspeed
    risk 0.52cvss 7.5epss 0.43

    The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API.

  • CVE-2016-2164HigApr 11, 2016
    Apache
    Openmeetings
    risk 0.49cvss 7.5epss 0.07

    The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by…

  • CVE-2016-0783HigApr 11, 2016
    Apache
    Openmeetings
    risk 0.49cvss 7.5epss 0.07

    The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remote attackers to reset arbitrary user passwords by leveraging knowledge of a user name and the current system time.

  • CVE-2016-0710HigApr 11, 2016
    Apache
    Jetspeed
    risk 0.64cvss 8.8epss 0.52

    Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.

  • CVE-2016-0709HigApr 11, 2016
    Apache
    Jetspeed
    risk 0.56cvss 7.2epss 0.78

    Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry,…

  • CVE-2015-8240HigApr 11, 2016
    F5, Inc.
    Big IP
    risk 0.49cvss 7.5epss 0.02

    The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.0 HF6 and BIG-IP PSM before 11.4.1 HF10 does not properly handle TCP options, which…

  • CVE-2016-1033HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1032HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1031HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.05

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011,…

  • CVE-2016-1030HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.53cvss 8.1epss 0.05

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to bypass intended access restrictions via unspecified vectors.

  • CVE-2016-1029HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1028HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1027HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1026HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1025HigApr 9, 2016
    GNU
    Flash Player
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1024HigApr 9, 2016
    GNU
    Flash Player
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1023HigApr 9, 2016
    GNU
    Flash Player
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1022HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1021HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1020HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1018HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.08

    Stack-based buffer overflow in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via crafted JPEG-XR data.

  • CVE-2016-1017HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.06

    Use-after-free vulnerability in the LoadVars.decode function in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different…

  • CVE-2016-1016HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.06

    Use-after-free vulnerability in the Transform object implementation in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via a flash.geom.Matrix callback, a…

  • CVE-2016-1015HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.07

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code by overriding NetConnection object properties to leverage an unspecified "type confusion," a different…

  • CVE-2016-1014HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.48cvss 7.3epss 0.01

    Untrusted search path vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows local users to gain privileges via a Trojan horse resource in an unspecified directory.

  • CVE-2016-1013HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.62cvss 8.8epss 0.23

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011,…

  • CVE-2016-1012HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1011HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.62cvss 8.8epss 0.26

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1013,…

  • CVE-2016-1006HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.53cvss 8.1epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to bypass the ASLR protection mechanism via JIT data.

  • CVE-2016-3983HigApr 8, 2016
    McAfee
    Advanced Threat Defense
    risk 0.49cvss 7.5epss 0.01

    McAfee Advanced Threat Defense (ATD) before 3.4.8.178 might allow remote attackers to bypass malware detection by leveraging information about the parent process.

  • CVE-2016-2512HigApr 8, 2016
    Djangoproject
    Django
    risk 0.41cvss 7.4epss 0.04

    The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as…

  • CVE-2016-2381HigApr 8, 2016
    Perl Foundation
    Perl
    risk 0.49cvss 7.5epss 0.09

    Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

  • CVE-2015-5229HigApr 8, 2016
    Red Hat
    glibc
    risk 0.49cvss 7.5epss 0.02

    The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.

  • CVE-2016-3980HigApr 8, 2016
    SAP
    Java As
    risk 0.49cvss 7.5epss 0.07

    The Java Startup Framework (aka jstart) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted HTTP request, aka SAP Security Note 2259547.

  • CVE-2016-3979HigApr 8, 2016
    SAP
    Java As
    risk 0.49cvss 7.5epss 0.06

    Internet Communication Manager (aka ICMAN or ICM) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (heap memory corruption and process crash) via a crafted HTTP request, related to the IctParseCookies function, aka SAP Security Note 2256185.

  • CVE-2016-3188HigApr 8, 2016
    Prepopulate Project
    Prepopulate
    risk 0.48cvss 7.3epss 0.02

    The _prepopulate_request_walk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the (1) actions, (2) container, (3) token, (4) password, (5) password_confirm, (6) text_format, or (7) markup field type, and consequently have…

  • CVE-2016-3187HigApr 8, 2016
    Drupal
    Prepopulate
    risk 0.48cvss 7.3epss 0.02

    The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the REQUEST superglobal array, and consequently have unspecified impact, via a base64-encoded pp parameter.

  • CVE-2015-6541HigApr 8, 2016
    Zimbra
    Collaboration Server
    risk 0.60cvss 8.8epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to…

  • CVE-2015-8840HigApr 8, 2016
    SAP
    Netweaver As Java
    risk 0.57cvss 8.8epss 0.01

    The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to (1) webcontent/cas/cas_enter.jsp,…

  • CVE-2016-3976HigKEVApr 7, 2016
    SAP
    Netweaver As Java
    risk 0.67cvss 7.5epss 0.47

    Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.

  • CVE-2016-2098HigApr 7, 2016
    Rubyonrails
    Rails
    risk 0.57cvss 7.3epss 0.81

    Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

  • CVE-2016-1531HigApr 7, 2016
    Exim
    Exim
    risk 0.49cvss 7.0epss 0.06

    Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

  • CVE-2016-0792HigApr 7, 2016
    Jenkins Project
    Jenkins
    risk 0.60cvss 8.8epss 0.83

    Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

  • CVE-2016-2216HigApr 7, 2016
    Node.js
    Node.js
    risk 0.49cvss 7.5epss 0.07

    The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP…

  • CVE-2016-2086HigApr 7, 2016
    Node.js
    Node.js
    risk 0.49cvss 7.5epss 0.06

    Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

  • CVE-2016-2510HigApr 7, 2016
    BeanShell
    BeanShell
    risk 0.51cvss 8.1epss 0.70

    BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

  • CVE-2015-8681HigApr 7, 2016
    Huawei
    P8
    risk 0.51cvss 7.8epss 0.01

    The ovisp driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before…

  • CVE-2015-8680HigApr 7, 2016
    Huawei
    P8
    risk 0.51cvss 7.8epss 0.01

    The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00…

  • CVE-2015-8319HigApr 7, 2016
    Huawei
    P8
    risk 0.51cvss 7.8epss 0.01

    Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones…

  • CVE-2015-8318HigApr 7, 2016
    Huawei
    P8
    risk 0.51cvss 7.8epss 0.01

    Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones…