56.742 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.742 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2015-4305 | MED 4.0 | cisco prime_collaboration_assurance The web framework in Cisco Prime Collaboration Assurance before 10.5.1.53684-1 allows remote authenticated users to bypass intended system-database read restrictions, and discover credentials or SNMP communities for arbitrary tenant domains, via a crafted URL, | 1.9% | — |
| CVE-2015-4295 | MED 4.0 | cisco unified_communications_manager The Prime Collaboration Deployment component in Cisco Unified Communications Manager 10.5(3.10000.9) allows remote authenticated users to discover root credentials via a direct request to an unspecified URL, aka Bug ID CSCuv21819. | 1.3% | — |
| CVE-2015-4269 | MED 4.0 | cisco unified_communications_manager The Tomcat throttling feature in Cisco Unified Communications Manager 10.5(1.99995.9) allows remote authenticated users to cause a denial of service (management outage) by sending many requests, aka Bug ID CSCuu99709. | 1.6% | — |
| CVE-2015-4263 | MED 4.0 | cisco mobility_services_engine The Control and Provisioning functionality in Cisco Mobility Services Engine (MSE) 10.0(0.1) allows remote authenticated users to obtain sensitive information by reading log files, aka Bug ID CSCut36851. | 1.5% | — |
| CVE-2015-4225 | MED 4.0 | cisco nx-os Cisco Application Policy Infrastructure Controller (APIC) 1.0(1.110a) and 1.0(1e) on Nexus 9000 devices does not properly implement RBAC health scoring, which allows remote authenticated users to obtain sensitive information via unspecified vectors, aka Bug ID | 2.0% | — |
| CVE-2015-4221 | MED 4.0 | cisco unified_communications_manager_im_and_presence_service Cisco Unified Communications Manager IM and Presence Service 9.1(1) does not properly restrict access to encrypted passwords, which allows remote attackers to determine cleartext passwords, and consequently execute arbitrary commands, by visiting an unspecifie | 2.3% | — |
| CVE-2015-4219 | MED 4.0 | cisco identity_services_engine_software Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information v | 2.1% | — |
| CVE-2015-4214 | MED 4.0 | cisco unified_meetingplace Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) allows remote authenticated users to discover cleartext passwords by reading HTML source code, aka Bug ID CSCuu33050. | 2.0% | — |
| CVE-2015-4213 | MED 4.0 | cisco nx-os Cisco NX-OS 1.1(1g) on Nexus 9000 devices allows remote authenticated users to discover cleartext passwords by leveraging the existence of a decryption mechanism, aka Bug ID CSCuu84391. | 2.6% | — |
| CVE-2015-4195 | MED 4.0 | cisco ios_xr Cisco IOS XR 5.1.1.K9SEC allows remote authenticated users to cause a denial of service (vty error, and SSH and TELNET outage) via a crafted disconnect action within an SSH session, aka Bug ID CSCul63127. | 1.6% | — |
| CVE-2015-4162 | MED 4.0 | paloaltonetworks pan-os XML external entity (XXE) vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows remote authenticated administrators to obtain sensitive information via crafted XML data. | 1.0% | — |
| CVE-2015-4040 | MED 4.0 | f5 big-ip_access_policy_manager Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the web root via unspecified vectors. | 6.8% | — |
| CVE-2015-3293 | MED 4.0 | fortinet fortimail FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command. | 1.0% | — |
| CVE-2015-3187 | MED 4.0 | apache subversion The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been | 6.4% | — |
| CVE-2015-2535 | MED 4.0 | microsoft windows_server_2008 Active Directory in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service outage) by creating multiple machine accounts, aka "Active Directory Denial of Service Vulnerab | 11.5% | — |
| CVE-2015-1456 | MED 4.0 | fortinet fortiauthenticator Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log at debug/startup/. | 1.4% | — |
| CVE-2015-0760 | MED 4.0 | cisco adaptive_security_appliance_software The IKEv1 implementation in Cisco ASA Software 7.x, 8.0.x, 8.1.x, and 8.2.x before 8.2.2.13 allows remote authenticated users to bypass XAUTH authentication via crafted IKEv1 packets, aka Bug ID CSCus47259. | 2.0% | — |
| CVE-2015-0758 | MED 4.0 | cisco unified_meetingplace The web-based user interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) i | 1.6% | — |
| CVE-2015-0739 | MED 4.0 | cisco firesight_system_software The Lights-Out Management (LOM) implementation in Cisco FireSIGHT System Software 5.3.0 on Sourcefire 3D Sensor devices allows remote authenticated users to perform arbitrary Baseboard Management Controller (BMC) file uploads via unspecified vectors, aka Bug I | 2.0% | — |
| CVE-2015-0683 | MED 4.0 | cisco unified_communications_domain_manager Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to obtain sensitive information via a file-inclusion attack, aka Bug ID CSCup94744. | 1.3% | — |
| CVE-2015-0680 | MED 4.0 | cisco unified_callmanager Cisco Unified Call Manager (CM) 9.1(2.1000.28) does not properly restrict resource requests, which allows remote authenticated users to read arbitrary files via unspecified vectors, aka Bug ID CSCuq44439. | 1.3% | — |
| CVE-2015-0673 | MED 4.0 | cisco mobility_services_engine Cisco Mobility Services Engine (MSE) 8.0(110.0) allows remote authenticated users to discover the passwords of arbitrary users by (1) reading log files or (2) using an unspecified GUI feature, aka Bug ID CSCut24792. | 1.3% | — |
| CVE-2015-0661 | MED 4.0 | cisco ios_xr The SNMPv2 implementation in Cisco IOS XR allows remote authenticated users to cause a denial of service (snmpd daemon reload) via a malformed SNMP packet, aka Bug ID CSCur25858. | 1.0% | — |
| CVE-2015-0620 | MED 4.0 | cisco telepresence_management_suite The XML parser in Cisco TelePresence Management Suite (TMS) 14.3(.2) and earlier does not properly handle external entities, which allows remote authenticated users to cause a denial of service via POST requests, aka Bug ID CSCus51494. | 1.3% | — |
| CVE-2015-0251 | MED 4.0 | apache subversion The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences. | 7.4% | — |