Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2017-1000061

xmlsec1: xmlsec vulnerable to external entity expansion

xmlsec 1.2.23 and before is vulnerable to XML External Entity Expansion when parsing crafted input documents, resulting in possible information disclosure or denial of service

CVSS 3.0 · 7.1 High EPSS 1.4% KEV · Not listed
Vendors
Redhat Xmlsec Project
Products
Enterprise Linux Xmlsec
CVE-2017-10356

OpenJDK: weak protection of key stores against brute forcing (Security, 8181692)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE, Java SE Embedded, JRockit executes to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Netapp Oracle and 1 more
Products
Debian Linux Active Iq Unified Manager Cloud Backup and 30 more
CVE-2017-3244

mysql: Server: DML unspecified vulnerability (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts).

CVSS 3.1 · 6.5 Medium EPSS 3.7% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 8 more
CVE-2017-5482

tcpdump: multiple overflow issues in protocol decoding

The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2016-8575.

CVSS 3.0 · 9.8 Critical EPSS 5.5% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2017-10165

mysql: Server: Replication unspecified vulnerability (CPU Oct 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.7.19 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.0 · 4.9 Medium EPSS 2.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Rhel Software Collections
CVE-2017-5115

chromium-browser: type confusion in v8

Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 26.3% KEV · Not listed
Vendors
Google Microsoft Redhat
Products
Chrome Windows Rhel Extras
CVE-2017-10274

OpenJDK: CardImpl incorrect state handling (Smart Card IO, 8169026)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Smart Card IO). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data as well as unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).

CVSS 3.1 · 6.8 Medium EPSS 2.6% KEV · Not listed
Vendors
Debian Netapp Oracle and 1 more
Products
Debian Linux Active Iq Unified Manager Cloud Backup and 27 more
CVE-2016-7930

tcpdump: multiple overflow issues in protocol decoding

The LLC/SNAP parser in tcpdump before 4.9.0 has a buffer overflow in print-llc.c:llc_print().

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2017-5035

chromium-browser: incorrect security ui in omnibox

Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Apple Debian Google and 2 more
Products
Macos Debian Linux Chrome and 5 more
CVE-2017-12159

keycloak: CSRF token fixation

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Keycloak Redhat
Products
Keycloak Enterprise Linux Server Jboss Single Sign On and 2 more
CVE-2017-1000089

jenkins-plugin-pipeline-build-step: Missing check of Item/Build permission (SECURITY-433)

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact with other elements in Jenkins. The Pipeline: Build Step Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins.

CVSS 3.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Redhat
Products
Pipeline\ Openshift
CVE-2017-15268

QEMU: I/O: potential memory exhaustion via websock connection to VNC

Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.

CVSS 3.0 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack
CVE-2016-3113

ovirt-engine: Reflected XSS when submitting config file for VNC/SPICE Connection

Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.1 · 6.1 Medium EPSS 2.7% KEV · Not listed
Vendors
Redhat
Products
Ovirt-engine
CVE-2017-16239

openstack-nova: Nova Filter Scheduler bypass through rebuild action

In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2016-4446

setroubleshoot-plugins: insecure commands.getoutput use in the allow_execstack plugin

The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filename, related to the commands.getoutput function.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat Setroubleshoot Project
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node and 3 more
CVE-2017-11610

supervisor: Command injection via malicious XML-RPC request

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

CVSS 3.0 · 8.8 High EPSS 87.5% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Cloudforms and 2 more
CVE-2016-9394

jasper: insufficient SIZ marker segment data sanity checks

The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.

CVSS 3.0 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Jasper Project Redhat
Products
Jasper Enterprise Linux
CVE-2017-3647

mysql: Server: Replication unspecified vulnerability (CPU Jul 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.0 · 4.4 Medium EPSS 2.8% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Rhel Software Collections