Vulnerabilities > Critical

DATE CVE VULNERABILITY TITLE RISK
2016-02-21 CVE-2016-2275 Improper Access Control vulnerability in Advantech Vesp211-232 Firmware and Vesp211-Eu Firmware
The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, which allows remote attackers to perform administrative actions via modified JavaScript code.
network
low complexity
advantech CWE-284
critical
 9.8
9.8
2016-02-19 CVE-2016-1154 SQL Injection vulnerability in Cuore Ec-Cube Help Plugin
SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
network
low complexity
cuore CWE-89
critical
 9.1
9.1
2016-02-18 CVE-2015-8151 OS Command Injection vulnerability in Symantec Encryption Management Server 3.3.2
Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote authenticated users to execute arbitrary OS commands by leveraging console administrator access.
network
low complexity
symantec CWE-78
critical
 9.1
9.1
2016-02-18 CVE-2015-8286 7PK - Security Features vulnerability in Zhuhai Raysharp Firmware
Zhuhai RaySharp firmware has a hardcoded root password, which makes it easier for remote attackers to obtain access via a session on TCP port 23 or 9000.
network
low complexity
zhuhai CWE-254
critical
 9.8
9.8
2016-02-17 CVE-2016-2397 Command Injection vulnerability in Sonicwall products
The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data.
network
low complexity
sonicwall CWE-77
critical
 9.8
9.8
2016-02-17 CVE-2016-2396 Command Injection vulnerability in Sonicwall products
The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via vectors related to configuration input.
network
low complexity
sonicwall CWE-77
critical
 9.9
9.9
2016-02-17 CVE-2016-2071 Permissions, Privileges, and Access Controls vulnerability in Citrix Netscaler 10.5/10.5E/11.0
Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, and 10.5.e before Build 59.1305.e allows remote attackers to gain privileges via unspecified NS Web GUI commands.
network
low complexity
citrix CWE-264
critical
 9.8
9.8
2016-02-16 CVE-2016-2386 SQL Injection vulnerability in SAP Netweaver Application Server Java 7.40
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
network
low complexity
sap CWE-89
critical
 9.8
9.8
2016-02-15 CVE-2016-0746 Use After Free vulnerability in multiple products
Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.
network
low complexity
f5 canonical debian opensuse apple CWE-416
critical
 9.8
9.8
2016-02-15 CVE-2016-2231 Data Processing Errors vulnerability in Huawei Mt882 Firmware V200R002B022
The Windows-based Host Interface Program (WHIP) service on Huawei SmartAX MT882 devices V200R002B022 Arg relies on the client to send a length field that is consistent with a buffer size, which allows remote attackers to cause a denial of service (device outage) or possibly have unspecified other impact via crafted traffic on TCP port 8701.
network
low complexity
huawei CWE-19
critical
 9.8
9.8