Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2016-7940

tcpdump: multiple overflow issues in protocol decoding

The STP parser in tcpdump before 4.9.0 has a buffer overflow in print-stp.c, multiple functions.

CVSS 3.0 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2016-7939

tcpdump: multiple overflow issues in protocol decoding

The GRE parser in tcpdump before 4.9.0 has a buffer overflow in print-gre.c, multiple functions.

CVSS 3.0 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2016-7931

tcpdump: multiple overflow issues in protocol decoding

The MPLS parser in tcpdump before 4.9.0 has a buffer overflow in print-mpls.c:mpls_print().

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2016-7929

tcpdump: multiple overflow issues in protocol decoding

The Juniper PPPoE ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-juniper.c:juniper_parse_header().

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2016-7927

tcpdump: multiple overflow issues in protocol decoding

The IEEE 802.11 parser in tcpdump before 4.9.0 has a buffer overflow in print-802_11.c:ieee802_11_radio_print().

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2017-0902

rubygems: DNS hijacking vulnerability

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

CVSS 3.0 · 8.1 High EPSS 4.8% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 8 more
CVE-2017-17806

kernel: HMAC implementation does not validate that the underlying cryptographic hash algorithm is unkeyed allowing local attackers to cause denial-of-service

The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 4 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 6 more
CVE-2016-9396

jasper: reachable assertion in JPC_NOMINALGAIN()

The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors.

CVSS 3.0 · 7.5 High EPSS 5.8% KEV · Not listed
Vendors
Jasper Project Redhat
Products
Jasper Enterprise Linux
CVE-2015-7977

ntp: restriction list NULL pointer dereference

ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.

CVSS 3.1 · 5.9 Medium EPSS 6.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2016-9560

jasper: stack-based buffer overflow in jpc_dec_tileinit()

Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.

CVSS 3.1 · 7.8 High EPSS 2.9% KEV · Not listed
Vendors
Debian Jasper Project Redhat
Products
Debian Linux Jasper Enterprise Linux and 6 more
CVE-2017-3457

mysql: Server: DML unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.7.17 and earlier. Easily "exploitable" vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.0 · 4.9 Medium EPSS 2.2% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Rhel Software Collections
CVE-2017-9725

kernel: Incorrect type conversion for size during dma allocation

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail.

CVSS 3.0 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Google Redhat
Products
Android Enterprise Linux Enterprise Mrg and 2 more
CVE-2017-3459

mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.17 and earlier. Easily "exploitable" vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.0 · 4.9 Medium EPSS 2.2% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Rhel Software Collections
CVE-2017-0553

libnl: Integer overflow in nlmsg_reserve()

An elevation of privilege vulnerability in libnl could enable a local malicious application to execute arbitrary code within the context of the Wi-Fi service. This issue is rated as Moderate because it first requires compromising a privileged process and is mitigated by current platform configurations. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32342065. NOTE: this issue also exists in the upstream libnl before 3.3.0 library.

CVSS 3.0 · 7.0 High EPSS 2.3% KEV · Not listed
Vendors
Google Redhat
Products
Android Enterprise Linux
CVE-2017-3460

mysql: Server: Audit Plug-in unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Audit Plug-in). Supported versions that are affected are 5.7.17 and earlier. Easily "exploitable" vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.0 · 4.9 Medium EPSS 2.2% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Rhel Software Collections
CVE-2017-3462

mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.0 · 4.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Debian Oracle Redhat
Products
Debian Linux Mysql Rhel Software Collections
CVE-2017-3157

libreoffice: Arbitrary file disclosure in Calc and Writer

By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem. Information could be retrieved by the attacker by, e.g., using hidden sections to store the information, tricking the user into saving the document and convincing the user to send the document back to the attacker. The vulnerability is mitigated by the need for the attacker to know the precise file path in the target system, and the need to trick the user into saving the document and sending it back.

CVSS 3.0 · 5.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Openoffice Debian Linux Enterprise Linux and 6 more
CVE-2017-3061

flash-plugin: multiple code execution issues fixed in APSB17-10

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability in the SWF parser. Successful exploitation could lead to arbitrary code execution.

CVSS 3.0 · 9.8 Critical EPSS 24.7% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Mac Os X Chrome Os and 5 more
CVE-2017-3305

mysql: incorrect enforcement of ssl-mode=REQUIRED in MySQL 5.5 and 5.6

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: C API). Supported versions that are affected are 5.5.55 and earlier and 5.6.35 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). NOTE: the previous information is from the April 2017 CPU. Oracle has not commented on third-party claims that this issue allows man-in-the-middle attackers to hijack the authentication of users by leveraging incorrect ordering of security parameter verification in a client, aka, "The Riddle".

CVSS 3.0 · 5.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Oracle Redhat
Products
Debian Linux Mysql Rhel Software Collections
CVE-2016-9634

gstreamer-plugins-good: Heap buffer overflow in FLIC decoder

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via the start_line parameter.

CVSS 3.0 · 9.8 Critical EPSS 8.8% KEV · Not listed
Vendors
Debian Gstreamer Redhat
Products
Debian Linux Gstreamer Enterprise Linux and 4 more