Vulnerabilities > Critical

DATE CVE VULNERABILITY TITLE RISK
2016-02-18 CVE-2015-8151 OS Command Injection vulnerability in Symantec Encryption Management Server 3.3.2
Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote authenticated users to execute arbitrary OS commands by leveraging console administrator access.
network
low complexity
symantec CWE-78
critical
 9.1
9.1
2016-02-18 CVE-2015-8286 7PK - Security Features vulnerability in Zhuhai Raysharp Firmware
Zhuhai RaySharp firmware has a hardcoded root password, which makes it easier for remote attackers to obtain access via a session on TCP port 23 or 9000.
network
low complexity
zhuhai CWE-254
critical
 9.8
9.8
2016-02-17 CVE-2016-2397 Command Injection vulnerability in Sonicwall products
The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data.
network
low complexity
sonicwall CWE-77
critical
 9.8
9.8
2016-02-17 CVE-2016-2396 Command Injection vulnerability in Sonicwall products
The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via vectors related to configuration input.
network
low complexity
sonicwall CWE-77
critical
 9.9
9.9
2016-02-17 CVE-2016-2071 Permissions, Privileges, and Access Controls vulnerability in Citrix Netscaler 10.5/10.5E/11.0
Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, and 10.5.e before Build 59.1305.e allows remote attackers to gain privileges via unspecified NS Web GUI commands.
network
low complexity
citrix CWE-264
critical
 9.8
9.8
2016-02-16 CVE-2016-2386 SQL Injection vulnerability in SAP Netweaver Application Server Java 7.40
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
network
low complexity
sap CWE-89
critical
 9.8
9.8
2016-02-15 CVE-2016-0746 Use After Free vulnerability in multiple products
Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.
network
low complexity
f5 canonical debian opensuse apple CWE-416
critical
 9.8
9.8
2016-02-15 CVE-2016-2231 Data Processing Errors vulnerability in Huawei Mt882 Firmware V200R002B022
The Windows-based Host Interface Program (WHIP) service on Huawei SmartAX MT882 devices V200R002B022 Arg relies on the client to send a length field that is consistent with a buffer size, which allows remote attackers to cause a denial of service (device outage) or possibly have unspecified other impact via crafted traffic on TCP port 8701.
network
low complexity
huawei CWE-19
critical
 9.8
9.8
2016-02-13 CVE-2016-1524 Unspecified vulnerability in Netgear Prosafe Network Management Software 300 1.5.0.11
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via a direct request for a /null URI.
low complexity
netgear
critical
 9.6
9.6
2016-02-12 CVE-2016-1986 Code Injection vulnerability in HP Continuous Delivery Automation 1.3.0
HP Continuous Delivery Automation (CDA) 1.30 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
network
low complexity
hp CWE-94
critical
 9.8
9.8