Vulnerabilities > Critical

DATE CVE VULNERABILITY TITLE RISK
2016-11-22 CVE-2016-9535 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Libtiff 4.0.6
tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling.
network
low complexity
libtiff CWE-119
critical
 9.8
9.8
2016-11-22 CVE-2016-9534 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Libtiff 4.0.6
tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp members.
network
low complexity
libtiff CWE-119
critical
 9.8
9.8
2016-11-22 CVE-2016-9533 Out-of-bounds Write vulnerability in Libtiff 4.0.6
tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers.
network
low complexity
libtiff CWE-787
critical
 9.8
9.8
2016-11-22 CVE-2016-9155 Improper Access Control vulnerability in Siemens products
The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CCMD3025-DN18 prior to version v1.394_S1; CCID1445-DN18, CCID1445-DN28, CCID1145-DN36, CFIS1425, CCIS1425, CFMS2025, CCMS2025, CVMS2025-IR, CFMW1025, CCMW1025 prior to version v2635_SP1 could allow an attacker with network access to the web server to obtain administrative credentials under certain circumstances.
network
low complexity
siemens CWE-284
critical
 9.8
9.8
2016-11-19 CVE-2016-9150 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Paloaltonetworks Pan-Os
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code via unspecified vectors.
network
low complexity
paloaltonetworks CWE-119
critical
 9.8
9.8
2016-11-15 CVE-2016-5763 7PK - Security Features vulnerability in Novell products
Vulnerability in Novell Open Enterprise Server (OES2015 SP1 before Scheduled Maintenance Update 10992, OES2015 before Scheduled Maintenance Update 10990, OES11 SP3 before Scheduled Maintenance Update 10991, OES11 SP2 before Scheduled Maintenance Update 10989) might allow authenticated remote attackers to perform unauthorized file access and modification.
network
low complexity
novell CWE-254
critical
 9.1
9.1
2016-11-15 CVE-2016-9287 SQL Injection vulnerability in Exponentcms Exponent CMS 2.4.0
In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults.
network
low complexity
exponentcms CWE-89
critical
 9.8
9.8
2016-11-14 CVE-2016-8902 SQL Injection vulnerability in Dotcms
SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.
network
low complexity
dotcms CWE-89
critical
 9.8
9.8
2016-11-11 CVE-2016-9288 SQL Injection vulnerability in Exponentcms Exponent CMS
In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "DragnDropReRank" is directly used without any filtration which caused SQL injection.
network
low complexity
exponentcms CWE-89
critical
 9.8
9.8
2016-11-11 CVE-2016-9272 SQL Injection vulnerability in Exponentcms Exponent CMS
A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.
network
low complexity
exponentcms CWE-89
critical
 9.1
9.1