Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2016-1961

Mozilla: Use-after-free in SetBody (MFSA 2016-24)

Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574.

CVSS 3.0 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 2 more
Products
Firefox Thunderbird Leap and 4 more
CVE-2016-1969

mozilla: out-of-bounds write with malicious font in graphite2 (MFSA 2016-38)

The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font.

CVSS 3.0 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Mozilla Redhat Sil
Products
Firefox Enterprise Linux Graphite2
CVE-2016-1974

Mozilla: Out-of-bounds read in HTML parser following a failed allocation (MFSA 2016-34)

The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document.

CVSS 3.0 · 8.8 High EPSS 3.0% KEV · Not listed
Vendors
Mozilla Opensuse Oracle and 2 more
Products
Firefox Thunderbird Leap and 4 more
CVE-2016-6325

tomcat: tomcat writable config files allow privilege escalation

The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Enterprise Linux Desktop and 8 more
CVE-2016-1978

nss: Use-after-free in NSS during SSL connections in low memory (MFSA 2016-15)

Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.

CVSS 3.0 · 7.3 High EPSS 2.4% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Network Security Services Enterprise Linux
CVE-2016-6340

QCI: uses MD5 as password hash algorithm on deployed systems

The kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces use of MD5 passwords on deployed systems, which makes it easier for attackers to determine cleartext passwords via a brute-force attack.

CVSS 3.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Quickstart Cloud Installer
CVE-2016-2053

kernel: Kernel panic and system lockup by triggering BUG_ON() in public_key_verify_signature()

The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Extras Rt
CVE-2015-8374

kernel: Information leak when truncating of compressed/inlined extents on BTRFS

fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandles compressed inline extents, which allows local users to obtain sensitive pre-truncation information from a file via a clone action.

CVSS 3.0 · 4.0 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Extras Rt
CVE-2016-9536

libtiff: t2p_process_jpeg_strip heap-buffer-overflow

tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098, aka "t2p_process_jpeg_strip heap-buffer-overflow."

CVSS 3.0 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Libtiff Redhat
Products
Libtiff Enterprise Linux
CVE-2016-9534

libtiff: TIFFFlushData1 heap-buffer-overflow

tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."

CVSS 3.0 · 9.8 Critical EPSS 3.6% KEV · Not listed
Vendors
Libtiff Redhat
Products
Libtiff Enterprise Linux
CVE-2014-0540

flash-plugin: multiple code execution or security bypass flaws (APSB14-18)

Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, and CVE-2014-0545.

CVSS 2.0 · 10.0 Critical EPSS 4.0% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Adobe Air Adobe Air Sdk Flash Player and 5 more
CVE-2014-1738

kernel: block: floppy: privilege escalation via FDRAWCMD floppy ioctl command

The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Debian Linux Oracle and 2 more
Products
Debian Linux Linux Kernel Linux and 9 more
CVE-2014-2440

mysql: unspecified vulnerability related to Client (CPU April 2014)

Unspecified vulnerability in the MySQL Client component in Oracle MySQL 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVSS 2.0 · 5.1 Medium EPSS 4.7% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Solaris and 6 more
CVE-2015-2151

xen: hypervisor memory corruption due to x86 emulator flaw (xsa123)

The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly execute arbitrary code via unspecified vectors.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2014-3466

gnutls: insufficient session id length check in _gnutls_read_server_hello (GNUTLS-SA-2014-3)

Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.

CVSS 2.0 · 6.8 Medium EPSS 11.2% KEV · Not listed
Vendors
Gnu Redhat
Products
Gnutls Enterprise Linux
CVE-2014-2430

mysql: unspecified DoS related to Performance Schema (CPU April 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.36 and earlier and 5.6.16 and earlier allows remote authenticated users to affect availability via unknown vectors related to Performance Schema.

CVSS 2.0 · 3.5 Low EPSS 3.3% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Solaris and 8 more
CVE-2014-3621

openstack-keystone: configuration data information leak through Keystone catalog

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

CVSS 2.0 · 4.0 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Keystone Enterprise Linux and 1 more
CVE-2014-3464

WS: Incomplete fix for CVE-2013-2133

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.

CVSS 2.0 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform
CVE-2014-3632

openstack-neutron: regression of fix for CVE-2013-6433

The default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014.1.2-4, as used in Red Hat Enterprise Linux Open Stack Platform 5.0 for Red Hat Enterprise Linux 6, allows remote attackers to gain privileges via a crafted configuration file. NOTE: this vulnerability exists because of a CVE-2013-6433 regression.

CVSS 2.0 · 7.6 High EPSS 2.5% KEV · Not listed
Vendors
Openstack Redhat
Products
Neutron Openstack