Vulnerabilities > Critical

DATE CVE VULNERABILITY TITLE RISK
2016-11-22 CVE-2016-9533 Out-of-bounds Write vulnerability in Libtiff 4.0.6
tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers.
network
low complexity
libtiff CWE-787
critical
 9.8
9.8
2016-11-22 CVE-2016-9155 Improper Access Control vulnerability in Siemens products
The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CCMD3025-DN18 prior to version v1.394_S1; CCID1445-DN18, CCID1445-DN28, CCID1145-DN36, CFIS1425, CCIS1425, CFMS2025, CCMS2025, CVMS2025-IR, CFMW1025, CCMW1025 prior to version v2635_SP1 could allow an attacker with network access to the web server to obtain administrative credentials under certain circumstances.
network
low complexity
siemens CWE-284
critical
 9.8
9.8
2016-11-19 CVE-2016-9150 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Paloaltonetworks Pan-Os
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code via unspecified vectors.
network
low complexity
paloaltonetworks CWE-119
critical
 9.8
9.8
2016-11-15 CVE-2016-5763 7PK - Security Features vulnerability in Novell products
Vulnerability in Novell Open Enterprise Server (OES2015 SP1 before Scheduled Maintenance Update 10992, OES2015 before Scheduled Maintenance Update 10990, OES11 SP3 before Scheduled Maintenance Update 10991, OES11 SP2 before Scheduled Maintenance Update 10989) might allow authenticated remote attackers to perform unauthorized file access and modification.
network
low complexity
novell CWE-254
critical
 9.1
9.1
2016-11-15 CVE-2016-9287 SQL Injection vulnerability in Exponentcms Exponent CMS 2.4.0
In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults.
network
low complexity
exponentcms CWE-89
critical
 9.8
9.8
2016-11-14 CVE-2016-8902 SQL Injection vulnerability in Dotcms
SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.
network
low complexity
dotcms CWE-89
critical
 9.8
9.8
2016-11-11 CVE-2016-9288 SQL Injection vulnerability in Exponentcms Exponent CMS
In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "DragnDropReRank" is directly used without any filtration which caused SQL injection.
network
low complexity
exponentcms CWE-89
critical
 9.8
9.8
2016-11-11 CVE-2016-9272 SQL Injection vulnerability in Exponentcms Exponent CMS
A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.
network
low complexity
exponentcms CWE-89
critical
 9.1
9.1
2016-11-10 CVE-2016-7489 Permissions, Privileges, and Access Controls vulnerability in Teradata Virtual Machine 15.10
Teradata Virtual Machine Community Edition v15.10's perl script /opt/teradata/gsctools/bin/t2a.pl creates files in /tmp in an insecure manner, this may lead to elevated code execution.
network
low complexity
teradata CWE-264
critical
 9.8
9.8
2016-11-10 CVE-2016-4095 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Adobe products
Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
network
low complexity
adobe CWE-119
critical
 9.8
9.8