Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2017-7400

python-django-horizon: XSS in federation mappings UI

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.

CVSS 3.0 · 4.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Openstack Redhat
Products
Horizon Openstack
CVE-2017-2928

flash-plugin: multiple code execution issues fixed in APSB17-02

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to setting visual mode effects. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 5.0% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Mac Os X Chrome Os and 5 more
CVE-2016-2161

httpd: DoS vulnerability in mod_auth_digest

In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.

CVSS 3.0 · 7.5 High EPSS 21.0% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Jboss Core Services and 1 more
CVE-2017-3074

flash-plugin: multiple code execution issues fixed in APSB17-15

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Graphics class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 5.0% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 9 more
CVE-2016-10164

libXpm: Out-of-bounds write in XPM extension parsing

Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.

CVSS 3.0 · 9.8 Critical EPSS 7.6% KEV · Not listed
Vendors
Redhat X.org
Products
Enterprise Linux Libxpm
CVE-2017-3081

flash-plugin: multiple code execution issues fixed in APSB17-17

Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability during internal computation caused by multiple display object mask manipulations. Successful exploitation could lead to arbitrary code execution.

CVSS 3.0 · 9.8 Critical EPSS 15.9% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Mac Os X Chrome Os and 5 more
CVE-2017-7393

tigervnc: Double free via crafted fences

In TigerVNC 1.7.1 (VNCSConnectionST.cxx VNCSConnectionST::fence), an authenticated client can cause a double free, leading to denial of service or potentially code execution.

CVSS 3.0 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Redhat Tigervnc
Products
Enterprise Linux Tigervnc
CVE-2017-2862

gdk-pixbuf2: Heap overflow in the gdk_pixbuf__jpeg_image_load_increment function

An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.

CVSS 3.1 · 7.8 High EPSS 4.6% KEV · Not listed
Vendors
Debian Gnome Redhat
Products
Debian Linux Gdk-pixbuf Enterprise Linux
CVE-2017-9310

Qemu: net: infinite loop in e1000e NIC emulation

QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of service (infinite loop) via vectors related to setting the initial receive / transmit descriptor head (TDH/RDH) outside the allocated descriptor buffer.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Enterprise Linux and 1 more
CVE-2017-7551

389-ds-base: Password brute-force possible for locked account due to different return codes

389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.

CVSS 3.0 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Enterprise Linux
CVE-2017-5085

chromium-browser: inappropriate javascript execution on webui pages

Inappropriate implementation in Bookmarks in Google Chrome prior to 59 for iOS allowed a remote attacker who convinced the user to perform certain operations to run JavaScript on chrome:// pages via a crafted bookmark.

CVSS 3.0 · 6.1 Medium EPSS 1.0% KEV · Not listed
Vendors
Apple Google Redhat
Products
Iphone Os Chrome Rhel Extras
CVE-2017-3320

mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.7.16 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS v3.0 Base Score 2.4 (Confidentiality impacts).

CVSS 3.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Rhel Software Collections
CVE-2016-7062

rhscon-ceph: password leak by command line parameter

rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain the password as cleartext.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Rhscon Storage Console Storage Console Node
CVE-2016-7060

QCI: qci exposes password in web UI when they should be masked

The web interface in Red Hat QuickStart Cloud Installer (QCI) 1.0 does not mask passwords fields, which allows physically proximate attackers to obtain sensitive password information by reading the display.

CVSS 3.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Qci Quickstart Cloud Installer
CVE-2016-7050

RESTEasy: SerializableProvider enabled by default and deserializes untrusted data

SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code.

CVSS 3.0 · 9.8 Critical EPSS 5.3% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node and 2 more
CVE-2016-8327

mysql: Server: Replication unspecified vulnerability (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 4.4 (Availability impacts).

CVSS 3.0 · 4.4 Medium EPSS 2.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Rhel Software Collections
CVE-2017-15265

kernel: Use-after-free in snd_seq_ioctl_create_port()

Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 4 more