Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 83

CVE-2016-5388

Tomcat: CGI sets environmental variable based on user supplied Proxy request header

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.

CVSS 3.0 · 8.1 High EPSS 50.9% KEV · Not listed
Vendors
Apache Hp Oracle and 1 more
Products
Tomcat System Management Homepage Linux and 10 more
CVE-2016-3718

ImageMagick: SSRF vulnerability

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

CVSS 3.1 · 5.5 Medium EPSS 75.6% KEV · Listed
Vendors
Canonical Imagemagick Opensuse and 3 more
Products
Ubuntu Linux Imagemagick Leap and 28 more
CVE-2015-5300

ntp: MITM attacker can force ntpd to make a step larger than the panic threshold

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).

CVSS 3.0 · 7.5 High EPSS 9.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2015-3315

abrt: Various race-conditions and symlink issues found in abrt

Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files via a symlink attack on (1) /var/tmp/abrt/*/maps, (2) /tmp/jvm-*/hs_error.log, (3) /proc/*/exe, (4) /etc/os-release in a chroot, or (5) an unspecified root directory related to librpm.

CVSS 3.0 · 7.8 High EPSS 4.8% KEV · Not listed
Vendors
Redhat
Products
Automatic Bug Reporting Tool Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2016-0596

mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 14 more
CVE-2015-4819

mysql: unspecified vulnerability related to Client programs (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 13 more
CVE-2015-3329

php: buffer overflow in phar_set_inode()

Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.

CVSS 2.0 · 7.5 High EPSS 38.2% KEV · Not listed
Vendors
Apple Oracle Php and 1 more
Products
Mac Os X Linux Solaris and 9 more
CVE-2015-4147

php: SoapClient's __call() type confusion through unserialize()

The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.

CVSS 2.0 · 7.5 High EPSS 12.2% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-3307

php: invalid pointer free() in phar_tar_process_metadata()

The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.

CVSS 2.0 · 7.5 High EPSS 6.7% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2016-0695

OpenJDK: insufficient DSA key parameters checks (Security, 8138593)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security.

CVSS 3.0 · 5.9 Medium EPSS 3.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Jrockit and 11 more
CVE-2014-9674

freetype: multiple integer overflows Mac_Read_POST_Resource() leading to heap-based buffer overflows

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

CVSS 2.0 · 7.5 High EPSS 5.7% KEV · Not listed
Vendors
Canonical Fedoraproject Freetype and 3 more
Products
Ubuntu Linux Fedora Freetype and 9 more
CVE-2015-2301

php: use after free in phar_object.c

Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.

CVSS 2.0 · 7.5 High EPSS 14.7% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Mac Os X Ubuntu Linux Debian Linux and 10 more
CVE-2015-1863

wpa_supplicant: P2P SSID processing vulnerability

Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.

CVSS 2.0 · 5.8 Medium EPSS 5.2% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Opensuse and 8 more
CVE-2014-9657

freetype: off-by-one buffer over-read in tt_face_load_hdmx()

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2014-9658

freetype: buffer over-read and integer underflow in tt_face_load_kern()

The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2016-3698

libndp: denial of service due to insufficient validation of source of NDP messages

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.

CVSS 3.0 · 8.1 High EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Libndp and 1 more
Products
Ubuntu Linux Debian Linux Libndp and 8 more