Search
Total
9231 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2014-8824 | 1 Apple | 1 Mac Os X | 2017-09-08 | 10.0 HIGH | N/A |
| The kernel in Apple OS X before 10.10.2 does not properly validate IODataQueue object metadata fields, which allows attackers to execute arbitrary code in a privileged context via a crafted app. | |||||
| CVE-2014-8036 | 1 Cisco | 1 Webex Meetings Server | 2017-09-08 | 5.0 MEDIUM | N/A |
| The outlookpa component in Cisco WebEx Meetings Server does not properly validate API input, which allows remote attackers to modify a meeting's invite list via a crafted URL, aka Bug ID CSCuj40254. | |||||
| CVE-2014-7989 | 1 Cisco | 8 B200 M3, B200 M4, B22 M3 and 5 more | 2017-09-08 | 6.8 MEDIUM | N/A |
| Cisco Unified Computing System on B-Series blade servers allows local users to gain shell privileges via a crafted (1) ping6 or (2) traceroute6 command, aka Bug ID CSCuq38176. | |||||
| CVE-2014-7278 | 1 Zyxel | 2 Sbg3300-n, Sbg3300-n Firmware | 2017-09-08 | 5.0 MEDIUM | N/A |
| The login page on the ZyXEL SBG-3300 Security Gateway with firmware 1.00(AADY.4)C0 and earlier allows remote attackers to cause a denial of service (persistent web-interface outage) via JavaScript code within unspecified "welcome message" form data that is improperly handled during use for the loginMsg variable's value, a different vulnerability than CVE-2014-7277. | |||||
| CVE-2014-7146 | 1 Mantisbt | 1 Mantisbt | 2017-09-08 | 7.5 HIGH | N/A |
| The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier. | |||||
| CVE-2014-8836 | 1 Apple | 1 Mac Os X | 2017-09-08 | 10.0 HIGH | N/A |
| The Bluetooth driver in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (arbitrary-size bzero of kernel memory) via a crafted app. | |||||
| CVE-2015-0620 | 1 Cisco | 1 Telepresence Management Suite | 2017-09-08 | 4.0 MEDIUM | N/A |
| The XML parser in Cisco TelePresence Management Suite (TMS) 14.3(.2) and earlier does not properly handle external entities, which allows remote authenticated users to cause a denial of service via POST requests, aka Bug ID CSCus51494. | |||||
| CVE-2015-0606 | 1 Cisco | 1 Ios | 2017-09-08 | 4.9 MEDIUM | N/A |
| The IOS Shell in Cisco IOS allows local users to cause a denial of service (device crash) via unspecified commands, aka Bug ID CSCur59696. | |||||
| CVE-2014-8825 | 1 Apple | 1 Mac Os X | 2017-09-08 | 7.2 HIGH | N/A |
| The kernel in Apple OS X before 10.10.2 does not properly perform identitysvc validation of certain directory-service functionality, which allows local users to gain privileges or spoof directory-service responses via unspecified vectors. | |||||
| CVE-2014-6135 | 1 Ibm | 2 Security Appscan, Security Appscan Source | 2017-09-08 | 4.3 MEDIUM | N/A |
| IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote attackers to conduct clickjacking attacks via unspecified vectors. | |||||
| CVE-2015-0604 | 1 Cisco | 4 Unified Ip Phone 9951, Unified Ip Phone 9971, Unified Ip Phones 9951 Firmware and 1 more | 2017-09-08 | 5.0 MEDIUM | N/A |
| The web framework on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to upload files to arbitrary locations on a phone's filesystem via crafted HTTP requests, aka Bug ID CSCup90424. | |||||
| CVE-2014-6105 | 1 Ibm | 1 Security Identity Manager | 2017-09-08 | 4.3 MEDIUM | N/A |
| IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to conduct clickjacking attacks via unspecified vectors. | |||||
| CVE-2015-0601 | 1 Cisco | 4 Unified Ip Phone 9951, Unified Ip Phone 9971, Unified Ip Phones 9951 Firmware and 1 more | 2017-09-08 | 4.6 MEDIUM | N/A |
| Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allow local users to cause a denial of service (device reload) via crafted commands, aka Bug ID CSCup92790. | |||||
| CVE-2014-7899 | 1 Google | 1 Chrome | 2017-09-08 | 5.0 MEDIUM | N/A |
| Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string. | |||||
| CVE-2014-6197 | 1 Ibm | 5 Security Network Protection Xgs 3100, Security Network Protection Xgs 4100, Security Network Protection Xgs 5100 and 2 more | 2017-09-08 | 4.3 MEDIUM | N/A |
| IBM Security Network Protection 5.1.x and 5.2.x before 5.2.0.0 FP5 and 5.3.x before 5.3.0.0 FP1 allows remote attackers to conduct clickjacking attacks via unspecified vectors. | |||||
| CVE-2014-6159 | 1 Ibm | 1 Db2 | 2017-09-08 | 3.5 LOW | N/A |
| IBM DB2 9.7 before FP10, 9.8 through FP5, 10.1 through FT4, and 10.5 through FP4 on Linux, UNIX, and Windows, when immediate AUTO_REVAL is enabled, allows remote authenticated users to cause a denial of service (daemon crash) via a crafted ALTER TABLE statement. | |||||
| CVE-2015-1043 | 1 Vmware | 3 Fusion, Player, Workstation | 2017-09-08 | 3.3 LOW | N/A |
| The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors. | |||||
| CVE-2012-6687 | 1 Fastcgi | 1 Fcgi | 2017-09-08 | 5.0 MEDIUM | N/A |
| FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number of connections. | |||||
| CVE-2014-5472 | 1 Linux | 1 Linux Kernel | 2017-09-08 | 4.0 MEDIUM | N/A |
| The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry. | |||||
| CVE-2014-6151 | 1 Ibm | 1 Tivoli Integrated Portal | 2017-09-08 | 3.5 LOW | N/A |
| CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. | |||||
| CVE-2016-2548 | 1 Linux | 1 Linux Kernel | 2017-09-07 | 4.9 MEDIUM | 6.2 MEDIUM |
| sound/core/timer.c in the Linux kernel before 4.4.1 retains certain linked lists after a close or stop action, which allows local users to cause a denial of service (system crash) via a crafted ioctl call, related to the (1) snd_timer_close and (2) _snd_timer_stop functions. | |||||
| CVE-2016-2977 | 1 Ibm | 1 Sametime | 2017-09-07 | 4.0 MEDIUM | 4.3 MEDIUM |
| IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a malicious user to lower other users hands in the meeting. IBM X-Force ID: 113937. | |||||
| CVE-2017-13709 | 1 Flightgear | 1 Flightgear | 2017-09-06 | 6.4 MEDIUM | 7.5 HIGH |
| In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affects the contents of the global Property Tree. | |||||
| CVE-2015-1443 | 1 Fli4l | 1 Fli4l | 2017-09-06 | 9.0 HIGH | 8.8 HIGH |
| The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code. | |||||
| CVE-2015-1554 | 1 Kgb-bot Project | 1 Kgb-bot | 2017-09-05 | 5.0 MEDIUM | 7.5 HIGH |
| kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash). | |||||
| CVE-2017-12775 | 1 Question2answer | 1 Question2answer | 2017-09-05 | 5.0 MEDIUM | 7.5 HIGH |
| qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts. | |||||
| CVE-2016-5674 | 2 Netgear, Nuuo | 3 Readynas Surveillance, Nvrmini 2, Nvrsolo | 2017-09-03 | 10.0 HIGH | 9.8 CRITICAL |
| __debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter. | |||||
| CVE-2016-1464 | 1 Cisco | 1 Webex Wrf Player T29 | 2017-09-03 | 9.3 HIGH | 7.8 HIGH |
| Cisco WebEx Meetings Player T29.10, when WRF file support is enabled, allows remote attackers to execute arbitrary code via a crafted file, aka Bug ID CSCva09375. | |||||
| CVE-2016-8017 | 1 Mcafee | 1 Virusscan Enterprise | 2017-09-03 | 4.0 MEDIUM | 4.1 MEDIUM |
| Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read files on the webserver via a crafted user input. | |||||
| CVE-2016-10176 | 1 Netgear | 2 Wnr2000v5, Wnr2000v5 Firmware | 2017-09-03 | 7.5 HIGH | 9.8 CRITICAL |
| The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL, apply_noauth.cgi, that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) and achieve remote code execution. | |||||
| CVE-2016-5675 | 2 Netgear, Nuuo | 4 Readynas Surveillance, Crystal, Nvrmini 2 and 1 more | 2017-09-03 | 10.0 HIGH | 9.8 CRITICAL |
| handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter. | |||||
| CVE-2016-6512 | 1 Wireshark | 1 Wireshark | 2017-09-03 | 4.3 MEDIUM | 5.9 MEDIUM |
| epan/dissectors/packet-wap.c in Wireshark 2.x before 2.0.5 omits an overflow check in the tvb_get_guintvar function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet, related to the MMSE, WAP, WBXML, and WSP dissectors. | |||||
| CVE-2016-6503 | 1 Wireshark | 1 Wireshark | 2017-09-03 | 4.3 MEDIUM | 5.9 MEDIUM |
| The CORBA IDL dissectors in Wireshark 2.x before 2.0.5 on 64-bit Windows platforms do not properly interact with Visual C++ compiler options, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. | |||||
| CVE-2016-10503 | 1 Ibm | 1 Sametime | 2017-09-02 | 4.0 MEDIUM | 4.3 MEDIUM |
| IBM Sametime Meeting Server 8.5.2 and 9.0 could allow an authenticated and invited user of Sametime meeting to lower any or all hands in an e-meeting, thus spoofing results of votes in the meeting. IBM X-Force ID: 113803. | |||||
| CVE-2016-1370 | 1 Cisco | 2 Network Analysis Module, Network Analysis Module Software | 2017-09-02 | 5.0 MEDIUM | 5.3 MEDIUM |
| Cisco Prime Network Analysis Module (NAM) before 6.2(1-b) miscalculates IPv6 payload lengths, which allows remote attackers to cause a denial of service (mond process crash and monitoring outage) via crafted IPv6 packets, aka Bug ID CSCuy37324. | |||||
| CVE-2017-3316 | 1 Oracle | 1 Vm Virtualbox | 2017-09-02 | 6.0 MEDIUM | 8.4 HIGH |
| Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS v3.0 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). | |||||
| CVE-2017-12961 | 1 Gnu | 1 Pspp | 2017-09-02 | 5.0 MEDIUM | 7.5 HIGH |
| There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service. | |||||
| CVE-2016-1463 | 1 Cisco | 1 Firesight System Software | 2017-09-01 | 5.0 MEDIUM | 7.5 HIGH |
| Cisco FireSIGHT System Software 5.3.0, 5.3.1, 5.4.0, 6.0, and 6.0.1 allows remote attackers to bypass Snort rules via crafted parameters in the header of an HTTP packet, aka Bug ID CSCuz20737. | |||||
| CVE-2016-6239 | 1 Openbsd | 1 Openbsd | 2017-09-01 | 4.9 MEDIUM | 5.5 MEDIUM |
| The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large size value. | |||||
| CVE-2016-1450 | 1 Cisco | 1 Webex Meetings Server | 2017-09-01 | 6.0 MEDIUM | 7.5 HIGH |
| Cisco WebEx Meetings Server 2.6 allows remote authenticated users to conduct command-injection attacks via vectors related to an upload's file type, aka Bug ID CSCuy92715. | |||||
| CVE-2016-1374 | 1 Cisco | 1 Unified Computing System Performance Manager | 2017-09-01 | 9.0 HIGH | 8.8 HIGH |
| The web framework in Cisco Unified Computing System (UCS) Performance Manager 2.0.0 and earlier allows remote authenticated users to execute arbitrary commands via crafted parameters in a GET request, aka Bug ID CSCuy07827. | |||||
| CVE-2017-0312 | 2 Microsoft, Nvidia | 2 Windows, Gpu Driver | 2017-09-01 | 7.2 HIGH | 7.8 HIGH |
| All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscapeID 0x100008b where user provided input is used as the limit for a loop may lead to denial of service or potential escalation of privileges | |||||
| CVE-2016-1277 | 1 Juniper | 1 Junos | 2017-09-01 | 7.1 HIGH | 5.9 MEDIUM |
| Juniper Junos OS before 12.1X46-D50, 12.1X47 before 12.1X47-D40, 12.3X48 before 12.3X48-D30, 13.3 before 13.3R9, 14.1 before 14.1R8, 14.1X53 before 14.1X53-D40, 14.2 before 14.2R6, 15.1 before 15.1F6 or 15.1R3, and 15.1X49 before 15.1X49-D40, when configured with a GRE or IPIP tunnel, allow remote attackers to cause a denial of service (kernel panic) via a crafted ICMP packet. | |||||
| CVE-2016-1263 | 1 Juniper | 1 Junos | 2017-09-01 | 7.8 HIGH | 7.5 HIGH |
| Juniper Junos OS before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3X48 before 12.3X48-D30, 13.3 before 13.3R9-S1, 14.1 before 14.1R7, 14.2 before 14.2R6, 15.1 before 15.1F2-S5, 15.1F4 before 15.1F4-S2, 15.1R before 15.1R2-S3, 15.1 before 15.1R3, and 15.1X49 before 15.1X49-D40 allow remote attackers to cause a denial of service (kernel crash) via a crafted UDP packet destined to the interface IP address of a 64-bit OS device. | |||||
| CVE-2016-1707 | 1 Google | 1 Chrome | 2017-09-01 | 4.3 MEDIUM | 6.5 MEDIUM |
| ios/web/web_state/ui/crw_web_controller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure that an invalid URL is replaced with the about:blank URL, which allows remote attackers to spoof the URL display via a crafted web site. | |||||
| CVE-2016-5135 | 1 Google | 1 Chrome | 2017-09-01 | 4.3 MEDIUM | 6.5 MEDIUM |
| WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-policy information inside an HTML document during a preload request, which allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted web site, as demonstrated by a "Content-Security-Policy: referrer origin-when-cross-origin" header that overrides a "<META name='referrer' content='no-referrer'>" element. | |||||
| CVE-2016-4641 | 1 Apple | 1 Mac Os X | 2017-09-01 | 9.3 HIGH | 7.3 HIGH |
| Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or obtain sensitive user information via a crafted app that leverages a "type confusion." | |||||
| CVE-2016-1706 | 1 Google | 1 Chrome | 2017-09-01 | 9.3 HIGH | 9.6 CRITICAL |
| The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come from the browser process, which allows remote attackers to bypass a sandbox protection mechanism via an unexpected message type, related to broker_process_dispatcher.cc, ppapi_plugin_process_host.cc, ppapi_thread.cc, and render_frame_message_filter.cc. | |||||
| CVE-2017-13685 | 1 Sqlite | 1 Sqlite | 2017-08-31 | 4.3 MEDIUM | 5.5 MEDIUM |
| The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file. | |||||
| CVE-2017-3752 | 2 Ibm, Lenovo | 30 1\, 1g L2-7 Slb, Bladecenter and 27 more | 2017-08-30 | 4.3 MEDIUM | 8.2 HIGH |
| An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches. Exploitation of these implementation flaws may result in attackers being able to erase or alter the routing tables of one or many routers, switches, or other devices that support OSPF within a routing domain. | |||||