Vulnerabilities
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2016-09-20 | CVE-2015-8918 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products The archive_string_append function in archive_string.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted cab files, related to "overlapping memcpy." | 7.5 |
| 2016-09-20 | CVE-2015-8917 | NULL Pointer Dereference vulnerability in multiple products bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file. | 7.5 |
| 2016-09-20 | CVE-2015-8916 | NULL Pointer Dereference vulnerability in multiple products bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file. | 6.5 |
| 2016-09-20 | CVE-2015-8915 | Out-of-bounds Read vulnerability in Libarchive bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file. | 5.5 |
| 2016-09-19 | CVE-2016-6537 | Information Exposure vulnerability in Aver Eh6108H+ Firmware X9.03.24.00.07L AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent attacks to obtain sensitive information by reading these strings. | 7.5 |
| 2016-09-19 | CVE-2016-6536 | Permissions, Privileges, and Access Controls vulnerability in Aver Eh6108H+ Firmware X9.03.24.00.07L The /setup URI on AVer Information EH6108H+ devices with firmware X9.03.24.00.07l allows remote attackers to bypass intended page-access restrictions or modify passwords by leveraging knowledge of a handle parameter value. | 9.8 |
| 2016-09-19 | CVE-2016-6535 | Use of Hard-coded Credentials vulnerability in Aver Eh6108H+ Firmware X9.03.24.00.07L AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access by leveraging knowledge of the credentials and establishing a TELNET session. | 9.8 |
| 2016-09-19 | CVE-2016-6415 | Information Exposure vulnerability in Cisco IOS The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN. | 7.5 |
| 2016-09-19 | CVE-2016-5814 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Rockwellautomation products Buffer overflow in Rockwell Automation RSLogix Micro Starter Lite, RSLogix Micro Developer, RSLogix 500 Starter Edition, RSLogix 500 Standard Edition, and RSLogix 500 Professional Edition allows remote attackers to execute arbitrary code via a crafted RSS project file. | 8.6 |
| 2016-09-19 | CVE-2016-4860 | Improper Authentication vulnerability in Yokogawa Stardom Fcn/Fcj Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections, which allows remote attackers to reconfigure the device or cause a denial of service via a (1) stop application program, (2) change value, or (3) modify application command. | 7.3 |