Total
22093 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2016-6137 | 1 Sap | 1 Trex | 2016-09-28 | 10.0 HIGH | 9.8 CRITICAL |
| An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors, aka SAP Security Note 2203591. | |||||
| CVE-2016-4564 | 1 Imagemagick | 1 Imagemagick | 2016-09-23 | 7.5 HIGH | 9.8 CRITICAL |
| The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the next token, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted file. | |||||
| CVE-2016-6825 | 1 Huawei | 12 Rh1288 V3 Server, Rh1288 V3 Server Firmware, Rh2288 V3 Server and 9 more | 2016-09-08 | 5.0 MEDIUM | 9.8 CRITICAL |
| Huawei XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, and RH2288H V3 servers with software before V100R003C00SPC515 allow remote attackers to obtain passwords via a brute-force attack, related to "lack of authentication protection mechanisms." | |||||
| CVE-2016-7109 | 1 Huawei | 1 Uma | 2016-09-08 | 10.0 HIGH | 9.8 CRITICAL |
| Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vulnerability than CVE-2016-7110. | |||||
| CVE-2016-7110 | 1 Huawei | 1 Uma | 2016-09-08 | 10.0 HIGH | 9.8 CRITICAL |
| Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vulnerability than CVE-2016-7109. | |||||
| CVE-2016-2018 | 1 Hp | 2 Matrix Operating Environment, Systems Insight Manager | 2016-08-24 | 6.4 MEDIUM | 9.1 CRITICAL |
| HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors. | |||||
| CVE-2016-2024 | 1 Hp | 2 Insight Contol, Server Migration Package | 2016-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| HPE Insight Control before 7.5.1 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors. | |||||
| CVE-2016-6493 | 1 Citrix | 2 Xenapp, Xendesktop | 2016-08-23 | 7.5 HIGH | 9.8 CRITICAL |
| Citrix XenApp 6.x before 6.5 HRP07 and 7.x before 7.9 and Citrix XenDesktop before 7.9 might allow attackers to weaken an unspecified security mitigation via vectors related to memory permission. | |||||
| CVE-2016-2029 | 1 Hp | 2 Matrix Operating Environment, Systems Insight Manager | 2016-08-23 | 6.4 MEDIUM | 9.1 CRITICAL |
| HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-4358. | |||||
| CVE-2016-5817 | 1 Navis | 1 Webaccess | 2016-08-22 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in news pages in Cargotec Navis WebAccess before 2016-08-10 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | |||||
| CVE-2016-5667 | 1 Crestron | 2 Dm-txrx-100-str, Dm-txrx-100-str Firmware | 2016-08-15 | 7.5 HIGH | 9.8 CRITICAL |
| Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html. | |||||
| CVE-2016-5640 | 1 Crestron | 2 Airmedia Am-100, Airmedia Am-100 Firmware | 2016-08-15 | 10.0 HIGH | 9.8 CRITICAL |
| Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the ATE_COMMAND parameter. | |||||
| CVE-2016-5669 | 1 Crestron | 2 Dm-txrx-100-str, Dm-txrx-100-str Firmware | 2016-08-15 | 5.0 MEDIUM | 9.8 CRITICAL |
| Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 use a hardcoded 0xb9eed4d955a59eb3 X.509 certificate from an OpenSSL Test Certification Authority, which makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions by leveraging the certificate's trust relationship. | |||||
| CVE-2016-5666 | 1 Crestron | 2 Dm-txrx-100-str, Dm-txrx-100-str Firmware | 2016-08-15 | 5.0 MEDIUM | 9.8 CRITICAL |
| Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 rely on the client to perform authentication, which allows remote attackers to obtain access by setting the value of objresp.authenabled to 1. | |||||
| CVE-2016-5668 | 1 Crestron | 2 Dm-txrx-100-str, Dm-txrx-100-str Firmware | 2016-08-15 | 7.5 HIGH | 9.8 CRITICAL |
| Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call. | |||||
| CVE-2016-5670 | 1 Crestron | 2 Dm-txrx-100-str, Dm-txrx-100-str Firmware | 2016-08-15 | 10.0 HIGH | 9.8 CRITICAL |
| Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 have a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via the web management interface. | |||||
| CVE-2016-6178 | 1 Huawei | 10 Cloudengine 12800, Cloudengine 12800 Firmware, Cx600 and 7 more | 2016-08-03 | 7.5 HIGH | 9.8 CRITICAL |
| Huawei NE40E and CX600 devices with software before V800R007SPH017; PTN 6900-2-M8 devices with software before V800R007SPH019; NE5000E devices with software before V800R006SPH018; and CloudEngine devices 12800 with software before V100R003SPH010 and V100R005 before V100R005SPH006 allow remote attackers with control plane access to cause a denial of service or execute arbitrary code via a crafted packet. | |||||
| CVE-2016-1909 | 1 Fortinet | 1 Fortios | 2016-07-15 | 10.0 HIGH | 9.8 CRITICAL |
| Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access account, which allows remote attackers to obtain administrative access via an SSH session. | |||||
| CVE-2016-3742 | 1 Google | 1 Android | 2016-07-11 | 7.5 HIGH | 9.8 CRITICAL |
| decoder/ih264d_process_intra_mb.c in mediaserver in Android 6.x before 2016-07-01 mishandles intra mode, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28165659. | |||||
| CVE-2016-3743 | 1 Google | 1 Android | 2016-07-11 | 7.5 HIGH | 9.8 CRITICAL |
| decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-07-01 does not initialize certain data structures, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 27907656. | |||||