CVE-database
129.550 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2009-2197 MEDIUM · 4.3 Met Apple Safari vóór 9.1 kunnen externe aanvallers de gebruikersinterface vervalsen via een webpagina die tekst in een bewerkte context plaatst, wat leidt tot onbedoeld… Apple
- CVE-2016-3116 MEDIUM · 6.4 CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data. Dropbear Ssh Project
- CVE-2016-3115 MEDIUM · 6.4 Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding… Openbsd Oracle
- CVE-2016-1998 CRITICAL · 9.8 HPE Service Manager (SM) 9.3x before 9.35 P4 and 9.4x before 9.41.P2 allows remote attackers to execute arbitrary commands via a crafted serialized Java object,… Hp
- CVE-2016-1997 CRITICAL · 9.8 HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object,… Hp
- CVE-2015-7454 MEDIUM · 4.3 Business Space in IBM WebSphere Process Server 6.1.2.0 through 7.0.0.5 and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0.x through 8.5.0.2, 8.5.5.x… Ibm
- CVE-2016-2245 CRITICAL · 9.8 HP Support Assistant before 8.1.52.1 allows remote attackers to bypass authentication via unspecified vectors. Hp
- CVE-2016-0283 MEDIUM · 6.1 Cross-site scripting (XSS) kwetsbaarheid in de OpenID Connect (OIDC) client webapplicatie in IBM WebSphere Application Server (WAS) Liberty Profile 8.5.5 voordat 8.5.5.9 aanvallers op afstand… Ibm
- CVE-2016-2287 MEDIUM · 6.1 Cross-site scripting (XSS) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Xzeres
- CVE-2015-2286 MEDIUM · 6.5 lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens… Edx
- CVE-2016-3155 LOW · 3.4 Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecified vectors. Siemens
- CVE-2016-2281 HIGH · 7.2 Untrusted search path vulnerability in ABB Panel Builder 800 5.1 allows local users to gain privileges via a Trojan horse DLL in the current working… Abb
- CVE-2015-8154 HIGH · 8.8 The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows remote attackers… Symantec
- CVE-2015-8153 HIGH · 8.8 SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Symantec
- CVE-2015-8152 HIGH · 8.0 Cross-site request forgery (CSRF) vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for… Symantec
- CVE-2014-9768 HIGH · 8.8 IBM Tivoli NetView Access Services (NVAS) allows remote authenticated users to gain privileges by entering the ADM command and modifying a "page ID" field to… Ibm
- CVE-2016-1996 HIGH · 7.7 HPE System Management Homepage before 7.5.4 allows local users to obtain sensitive information or modify data via unspecified vectors. Hp
- CVE-2016-1995 CRITICAL · 9.8 HPE System Management Homepage before 7.5.4 allows remote attackers to execute arbitrary code via unspecified vectors. Hp
- CVE-2016-1994 MEDIUM · 6.5 HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information via unspecified vectors. Hp
- CVE-2016-1993 HIGH · 8.1 HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors. Hp
- CVE-2015-5968 MEDIUM · 6.1 Cross-site scripting (XSS) vulnerability in Novell Filr 1.2 before Hot Patch 4 allows remote attackers to inject arbitrary web script or HTML via a crafted… Novell
- CVE-2016-3191 CRITICAL · 9.8 The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with… Pcre
- CVE-2016-2345 CRITICAL · 9.8 Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code via a… Dameware
- CVE-2016-2342 HIGH · 8.1 The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on… Quagga Debian
- CVE-2016-1992 MEDIUM · 6.5 HPE ArcSight ESM before 6.8c, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to obtain sensitive information via unspecified vectors. Hp
- CVE-2016-2846 MEDIUM · 6.5 Siemens SIMATIC S7-1200 CPU devices before 4.0 allow remote attackers to bypass a "user program block" protection mechanism via unspecified vectors. Siemens
- CVE-2016-2075 MEDIUM · 5.4 Cross-site scripting (XSS) vulnerability in VMware vRealize Business Advanced and Enterprise 8.x before 8.2.5 on Linux allows remote authenticated users to inject arbitrary web script… Vmware Linux
- CVE-2016-1991 HIGH · 8.0 HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows remote… Microfocus
- CVE-2016-1990 HIGH · 7.8 HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows local… Microfocus
- CVE-2015-2344 MEDIUM · 5.4 Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web script or HTML via… Linux Vmware
- CVE-2016-1989 CRITICAL · 9.8 HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors, a… Hp
- CVE-2016-1988 CRITICAL · 9.8 HPE Network Automation 9.22 t/m 9.22.02 en 10.x voor 10.00.02 stelt externe aanvallers in staat om willekeurige code uit te voeren of gevoelige informatie te… Hp
- CVE-2016-2856 HIGH · 8.4 pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8 on Ubuntu 14.04… Canonical Debian Gnu
- CVE-2016-1731 MEDIUM · 5.9 Apple Software Update before 2.2 on Windows does not use HTTPS, which makes it easier for man-in-the-middle attackers to spoof updates by modifying the client-server… Apple
- CVE-2016-0262 MEDIUM · 5.4 Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1.1 through 7.1.1.3, 7.5.0 before 7.5.0.9 IFIX004, and 7.6.0 before 7.6.0.3 IFIX001 allows remote authenticated users… Ibm
- CVE-2016-0222 MEDIUM · 4.3 IBM Maximo Asset Management 7.6 before 7.6.0.3 IFIX001 allows remote authenticated users to bypass intended access restrictions and read arbitrary purchase-order work logs via unspecified… Ibm
- CVE-2016-0208 LOW · 3.7 IBM WebSphere Commerce 6.x through 6.0.0.11, 7.x through 7.0.0.9, and 8.x before 8.0.0.3 allows remote attackers to cause a denial of service (order-processing outage) via… Ibm
- CVE-2016-1645 HIGH · 8.8 Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allow remote attackers to… Google Debian Opensuse
- CVE-2016-1644 HIGH · 8.8 WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly restrict relayout scheduling, which allows remote attackers to cause a denial of… Google
- CVE-2016-1643 HIGH · 8.8 The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly maintain the user agent shadow DOM, which allows… Google
- CVE-2016-0771 MEDIUM · 5.9 The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured,… Samba
- CVE-2015-7560 MEDIUM · 6.5 The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated… Samba Canonical Debian
- CVE-2016-2802 HIGH · 8.8 The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to… Mozilla Opensuse Suse Sil
- CVE-2016-2801 HIGH · 8.8 The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote… Opensuse Suse Sil Oracle
- CVE-2016-2800 HIGH · 8.8 The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote… Mozilla Opensuse Suse Oracle
- CVE-2016-2799 HIGH · 8.8 Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7,… Oracle Opensuse Suse Mozilla
- CVE-2016-2798 HIGH · 8.8 The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to… Mozilla Sil Oracle Opensuse
- CVE-2016-2797 HIGH · 8.8 The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to… Oracle Mozilla Opensuse Suse
- CVE-2016-2796 HIGH · 8.8 Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7,… Sil Opensuse Suse Oracle
- CVE-2016-2795 HIGH · 8.8 The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory… Opensuse Suse Oracle Mozilla