Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2016-2109

openssl: ASN.1 BIO handling of large amounts of data

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

CVSS 3.0 · 7.5 High EPSS 29.2% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Enterprise Linux Desktop and 9 more
CVE-2015-8640

flash-plugin: multiple code execution issues fixed in APSB16-01

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.

CVSS 3.0 · 8.8 High EPSS 6.1% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 7 more
CVE-2016-2111

samba: Spoofing vulnerability when domain controller is configured

The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, a related issue to CVE-2015-0005.

CVSS 3.0 · 6.3 Medium EPSS 2.9% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Rhel Aus and 5 more
CVE-2016-2112

samba: Missing downgrade detection

The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.

CVSS 3.0 · 5.9 Medium EPSS 9.4% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Rhel Aus and 4 more
CVE-2015-8642

flash-plugin: multiple code execution issues fixed in APSB16-01

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.

CVSS 3.0 · 8.8 High EPSS 6.1% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 7 more
CVE-2016-2140

openstack-nova: Host data leak through resize/migration

The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2015-8643

flash-plugin: multiple code execution issues fixed in APSB16-01

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.

CVSS 3.0 · 8.8 High EPSS 6.1% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 7 more
CVE-2015-8644

flash-plugin: multiple code execution issues fixed in APSB16-01

Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."

CVSS 3.0 · 8.8 High EPSS 26.1% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 7 more
CVE-2015-8645

flash-plugin: multiple code execution issues fixed in APSB16-01

Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8460, and CVE-2015-8636.

CVSS 3.0 · 8.8 High EPSS 6.8% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 7 more
CVE-2016-2160

Privilege escalation when changing root password in sti builder image

Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allow remote authenticated users to execute commands with root privileges by changing the root password in an sti builder image.

CVSS 3.0 · 8.8 High EPSS 4.1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin
CVE-2015-8646

flash-plugin: multiple code execution issues fixed in APSB16-01

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.

CVSS 3.0 · 8.8 High EPSS 6.1% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 7 more
CVE-2015-8647

flash-plugin: multiple code execution issues fixed in APSB16-01

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.

CVSS 3.0 · 8.8 High EPSS 7.4% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 7 more
CVE-2015-8648

flash-plugin: multiple code execution issues fixed in APSB16-01

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8649, and CVE-2015-8650.

CVSS 3.0 · 8.8 High EPSS 7.4% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 7 more
CVE-2015-8650

flash-plugin: multiple code execution issues fixed in APSB16-01

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, and CVE-2015-8649.

CVSS 3.0 · 8.8 High EPSS 7.4% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 7 more
CVE-2016-2166

qpid-proton: reactor sends messages in clear if ssl is requested but not available

The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.

CVSS 3.0 · 6.5 Medium EPSS 4.3% KEV · Not listed
Vendors
Apache Fedoraproject Redhat
Products
Qpid Proton Fedora Satellite and 1 more
CVE-2015-8776

glibc: Segmentation fault caused by passing out-of-range data to strftime()

The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value.

CVSS 3.0 · 9.1 Critical EPSS 4.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2015-8779

glibc: Unbounded stack allocation in catopen function

Stack-based buffer overflow in the catopen function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long catalog name.

CVSS 3.0 · 9.8 Critical EPSS 6.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2015-8786

rabbitmq-server: DoS via lengths_age or lengths_incr parameter in the management plugin

The Management plugin in RabbitMQ before 3.6.1 allows remote authenticated users with certain privileges to cause a denial of service (resource consumption) via the (1) lengths_age or (2) lengths_incr parameter.

CVSS 3.0 · 6.5 Medium EPSS 3.5% KEV · Not listed
Vendors
Oracle Pivotal Software Redhat
Products
Solaris Rabbitmq Openstack
CVE-2015-8803

nettle: secp256 calculation bug

The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.

CVSS 3.0 · 9.8 Critical EPSS 4.2% KEV · Not listed
Vendors
Canonical Nettle Project Opensuse and 1 more
Products
Ubuntu Linux Nettle Leap and 2 more
CVE-2015-8804

nettle: miscalculations on secp384 curve

x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors.

CVSS 3.0 · 9.8 Critical EPSS 4.0% KEV · Not listed
Vendors
Canonical Nettle Project Opensuse and 1 more
Products
Ubuntu Linux Nettle Leap and 2 more