Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2017-3257

mysql: Server: InnoDB unspecified vulnerability (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.6.34 and earlier5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts).

CVSS 3.1 · 6.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 1 more
CVE-2017-3243

mysql: Server: Charsets unspecified vulnerability (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Charsets). Supported versions that are affected are 5.5.53 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 4.4 (Availability impacts).

CVSS 3.1 · 4.4 Medium EPSS 4.3% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 8 more
CVE-2017-9524

Qemu: nbd: segmentation fault due to client non-negotiation

The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all initialization occurs before talking to a client in the nbd_negotiate function.

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Enterprise Linux and 1 more
CVE-2017-3002

flash-plugin: multiple code execution issues fixed in APSB17-07

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability in the ActionScript2 TextField object related to the variable property. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 5.1% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 6 more
CVE-2017-2996

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability in Primetime SDK. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 4.9% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 6 more
CVE-2017-2994

flash-plugin: multiple code execution issues fixed in APSB17-07

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 6.3% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 6 more
CVE-2017-13007

tcpdump: Buffer over-read in print-pktap.c:pktap_if_print() in Apple PKTAP parser

The Apple PKTAP parser in tcpdump before 4.9.2 has a buffer over-read in print-pktap.c:pktap_if_print().

CVSS 3.0 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2017-5122

chromium-browser: out-of-bounds access in v8

Inappropriate use of table size handling in V8 in Google Chrome prior to 61.0.3163.100 for Windows allowed a remote attacker to trigger out-of-bounds access via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2017-2987

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable integer overflow vulnerability related to Flash Broker COM. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 8.5% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 6 more
CVE-2017-2984

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the h264 decoder routine. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 18.2% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 6 more
CVE-2017-2992

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability when parsing an MP4 header. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 32.7% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 6 more
CVE-2017-2988

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing garbage collection. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 18.1% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 6 more
CVE-2017-12613

apr: Out-of-bounds array deref in apr_time_exp*() functions

When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.

CVSS 3.1 · 7.1 High EPSS 1.7% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Portable Runtime Debian Linux Enterprise Linux and 14 more
CVE-2016-7978

ghostscript: reference leak in .setdevice allows use-after-free and remote code execution

Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.

CVSS 3.0 · 9.8 Critical EPSS 5.5% KEV · Not listed
Vendors
Artifex Redhat
Products
Ghostscript Enterprise Linux
CVE-2017-13673

QEMU: VGA: reachable assert failure during display update

The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty function.

CVSS 3.0 · 6.5 Medium EPSS 3.0% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack
CVE-2017-2932

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript MovieClip class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 24.6% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Mac Os X Chrome Os and 5 more
CVE-2017-16541

Mozilla: Proxy bypass using automount and autofs

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.

CVSS 3.1 · 6.5 Medium EPSS 3.7% KEV · Not listed
Vendors
Apple Debian Linux and 2 more
Products
Macos Debian Linux Linux Kernel and 8 more
CVE-2017-2928

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to setting visual mode effects. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 5.0% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Mac Os X Chrome Os and 5 more
CVE-2016-0634

bash: Arbitrary code execution via malicious hostname

The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.

CVSS 3.0 · 7.5 High EPSS 6.1% KEV · Not listed
Vendors
Gnu Redhat
Products
Bash Enterprise Linux