Manager
Vendor:
First CVE: Nov 18, 2013 · Active for 12 years
22
Total CVEs
More Total CVEs than 94% of tracked products
3.7
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
6.0
Avg CVSS
Higher Avg CVSS than 21% of tracked products
13.6%
KEV Rate
Higher KEV Rate than 98% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Manager over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 18, 2013
12 years ago
Most Recent CVE
May 13, 2019
2,629 days ago
CVE Severity & Scoring
Manager22 CVEs
18%
41%
36%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local3 (13.6%)
Network12 (54.5%)
Unknown7 (31.8%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low12 (54.5%)
High3 (13.6%)
Unknown7 (31.8%)
User Interaction
None13 (59.1%)
Unknown7 (31.8%)
Required2 (9.1%)
Privileges Required
Low2 (9.1%)
High0 (0.0%)
None13 (59.1%)
Unknown7 (31.8%)
Top CVEs
Signals from CVEs in this product scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-3427CRITICAL Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and avai | Apr 21, 2016 | 9.8 | 95 | YES | NO |
CVE-2016-3718MEDIUM The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted ima | May 5, 2016 | 5.5 | 93 | YES | YES |
CVE-2016-3715MEDIUM The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. | May 5, 2016 | 5.5 | 93 | YES | YES |
CVE-2016-1286HIGH named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature r | Mar 9, 2016 | 8.6 | 56 | NO | NO |
CVE-2016-1285MEDIUM named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a | Mar 9, 2016 | 6.8 | 56 | NO | NO |
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remot | Apr 1, 2015 | 3.7 | 52 | NO | NO |
CVE-2016-4953HIGH ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect aut | Jul 5, 2016 | 7.5 | 33 | NO | NO |
CVE-2016-4954HIGH The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed pa | Jul 5, 2016 | 7.5 | 31 | NO | NO |
CVE-2015-5300HIGH The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote atta | Jul 21, 2017 | 7.5 | 22 | NO | NO |
CVE-2015-5194HIGH The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands. | Jul 21, 2017 | 7.5 | 22 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (22 CVEs).
CISA KEV
3 CVEs
13.6% of CVEs· 98th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
9.1% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (22 CVEs).
Media Mentions
Signals from CVEs in this product scope (22 CVEs).
Top CNAs Publishing CVEs For Manager
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.1 | 13 | 6.7 | 32.7% | 3 | 2 |
| 1.7 | 8 | 4.8 | 10.9% | 0 | 0 |