Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 772

CVE-2015-1779

qemu: vnc: insufficient resource limiting in VNC websockets decoder

The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.

CVSS 3.1 · 8.6 High EPSS 6.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2015-3209

qemu: pcnet: multi-tmd buffer overflow in the tx path

Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.

CVSS 2.0 · 7.5 High EPSS 9.7% KEV · Not listed
Vendors
Arista Canonical Debian and 5 more
Products
Eos Ubuntu Linux Debian Linux and 17 more
CVE-2015-0499

mysql: unspecified vulnerability related to Server:Federated (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Federated.

CVSS 2.0 · 3.5 Low EPSS 4.9% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 13 more
CVE-2015-0501

mysql: unspecified vulnerability related to Server:Compiling (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling.

CVSS 2.0 · 5.7 Medium EPSS 10.3% KEV · Not listed
Vendors
Canonical Debian Juniper and 4 more
Products
Ubuntu Linux Debian Linux Junos Space and 13 more
CVE-2015-0505

mysql: unspecified vulnerability related to Server:DDL (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

CVSS 2.0 · 3.5 Low EPSS 5.2% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 13 more
CVE-2015-0433

mysql: unspecified vulnerability related to Server:InnoDB:DML (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to InnoDB : DML.

CVSS 2.0 · 4.0 Medium EPSS 5.4% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 15 more
CVE-2019-6470

dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries

There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation.

CVSS 3.1 · 6.5 Medium EPSS 8.8% KEV · Not listed
Vendors
Isc Opensuse Redhat
Products
Dhcpd Leap Enterprise Linux and 16 more
CVE-2013-5614

Mozilla: Sandbox restrictions not applied to nested object elements (MFSA 2013-107)

Mozilla Firefox before 26.0 and SeaMonkey before 2.23 do not properly consider the sandbox attribute of an IFRAME element during processing of a contained OBJECT element, which allows remote attackers to bypass intended sandbox restrictions via a crafted web site.

CVSS 2.0 · 4.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 4 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2014-0386

mysql: unspecified vulnerability related to Optimizer DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2014-0393

mysql: unspecified vulnerability related to InnoDB affecting integrity (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect integrity via unknown vectors related to InnoDB.

CVSS 2.0 · 3.3 Low EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2013-5908

mysql: unspecified vulnerability related to Error Handling DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote attackers to affect availability via unknown vectors related to Error Handling.

CVSS 2.0 · 2.6 Low EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2013-5612

Mozilla: Character encoding cross-origin XSS attack (MFSA 2013-106)

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 makes it easier for remote attackers to inject arbitrary web script or HTML by leveraging a Same Origin Policy violation triggered by lack of a charset parameter in a Content-Type HTTP header.

CVSS 2.0 · 4.3 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 4 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2014-0437

mysql: unspecified vulnerability related to Optimizer DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVSS 2.0 · 3.5 Low EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2014-0412

mysql: unspecified vulnerability related to InnoDB DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

CVSS 2.0 · 4.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2013-6425

pixman: integer underflow when handling trapezoids

Integer underflow in the pixman_trapezoid_valid macro in pixman.h in Pixman before 0.32.0, as used in X.Org server and cairo, allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Opensuse and 8 more
CVE-2014-0402

mysql: unspecified vulnerability related to Locking DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Locking.

CVSS 2.0 · 4.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2014-0401

mysql: unspecified DoS vulnerability (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors.

CVSS 2.0 · 4.0 Medium EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2023-1476

Kpatch: mm/mremap.c: incomplete fix for cve-2022-41222

A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Eus and 3 more
CVE-2023-0494

xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation

A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat X.org
Products
Fedora Enterprise Linux Enterprise Linux Aus and 19 more