Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2016-0791

jenkins: Non-constant time comparison of CSRF crumbs (SECURITY-245)

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.

CVSS 3.0 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2014-0451

OpenJDK: AWT incorrect FlavorMap seperation (AWT, 8026797)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-2412.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Oracle and 1 more
Products
Ubuntu Linux Debian Linux Jdk and 5 more
CVE-2014-0455

OpenJDK: MethodHandle variable argument lists handling (Libraries, 8029844)

Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-2402.

CVSS 2.0 · 9.3 Critical EPSS 5.5% KEV · Not listed
Vendors
Canonical Ibm Microsoft and 2 more
Products
Ubuntu Linux Forms Viewer Windows and 5 more
CVE-2014-0457

OpenJDK: ServiceLoader Exception handling security bypass (Libraries, 8031394)

Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0 · 10.0 Critical EPSS 6.8% KEV · Not listed
Vendors
Canonical Debian Ibm and 4 more
Products
Ubuntu Linux Debian Linux Forms Viewer and 9 more
CVE-2014-2402

OpenJDK: Incorrect NIO channel separation (Libraries, 8026716)

Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-0455.

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Jdk Jre and 3 more
CVE-2014-9112

cpio: heap-based buffer overflow flaw in list_file()

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

CVSS 2.0 · 5.0 Medium EPSS 7.1% KEV · Not listed
Vendors
Debian Gnu Redhat
Products
Debian Linux Cpio Enterprise Linux
CVE-2015-6789

chromium-browser: Use-after free in Blink

Race condition in the MutationObserver implementation in Blink, as used in Google Chrome before 47.0.2526.80, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact by leveraging unanticipated object deletion.

CVSS 2.0 · 9.3 Critical EPSS 1.7% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2016-2843

chromium-browser: Multiple unspecified vulnerabilities in V8 before 4.9.385.26

Multiple unspecified vulnerabilities in Google V8 before 4.9.385.26, as used in Google Chrome before 49.0.2623.75, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 3.0 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome V8 Rhel Extras
CVE-2015-7210

Mozilla: Use-after-free in WebRTC when datachannel is used after being destroyed (MFSA 2015-138)

Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC function.

CVSS 2.0 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Fedoraproject Mozilla Opensuse and 1 more
Products
Fedora Firefox Leap and 2 more
CVE-2016-4149

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2014-6463

mysql: unspecified vulnerability related to SERVER:REPLICATION ROW FORMAT BINARY LOG DML (CPU October 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:REPLICATION ROW FORMAT BINARY LOG DML.

CVSS 2.0 · 3.3 Low EPSS 2.8% KEV · Not listed
Vendors
Mariadb Oracle Redhat and 1 more
Products
Mariadb Mysql Solaris and 7 more
CVE-2015-8324

kernel: Null pointer dereference when mounting ext4

The ext4 implementation in the Linux kernel before 2.6.34 does not properly track the initialization of certain data structures, which allows physically proximate attackers to cause a denial of service (NULL pointer dereference and panic) via a crafted USB device, related to the ext4_fill_super function.

CVSS 3.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2014-9423

krb5: libgssrpc server applications leak uninitialized bytes (MITKRB5-SA-2015-001)

The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field.

CVSS 2.0 · 5.0 Medium EPSS 3.9% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux
CVE-2015-8710

libxml2: out-of-bounds memory access when parsing an unclosed HTML comment

The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.

CVSS 3.1 · 9.8 Critical EPSS 4.9% KEV · Not listed
Vendors
Debian Redhat Xmlsoft
Products
Debian Linux Enterprise Linux Jboss Enterprise Web Server and 1 more
CVE-2016-1617

chromium-browser: various fixes from internal audits

The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report.

CVSS 3.0 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2016-1641

chromium-browser: use-after-free in Favicon

Use-after-free vulnerability in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an image download after a certain data structure is deleted, as demonstrated by a favicon.ico download.

CVSS 3.0 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2015-8916

libarchive: NULL pointer access in RAR parser through bsdtar

bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file.

CVSS 3.0 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Libarchive and 1 more
Products
Ubuntu Linux Debian Linux Libarchive and 1 more
CVE-2016-1644

chromium-browser: use-after-free in Blink

WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly restrict relayout scheduling, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted HTML document.

CVSS 3.0 · 8.8 High EPSS 2.1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras