Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2016-1105

flash-plugin: multiple code execution issues fixed in APSB16-15

Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.

CVSS 3.0 · 7.5 High EPSS 37.7% KEV · Not listed
Vendors
Adobe Microsoft Redhat
Products
Flash Player Edge Internet Explorer and 1 more
CVE-2014-3483

rubygem-activerecord: SQL injection vulnerability in 'range' quoting

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.

CVSS 2.0 · 7.5 High EPSS 4.2% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Rhel Software Collections Rails
CVE-2015-4866

mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.

CVSS 2.0 · 4.0 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Mariadb Oracle and 1 more
Products
Ubuntu Linux Mariadb Mysql and 1 more
CVE-2016-1905

server: patch operation should use patched object to check admission control

The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.

CVSS 3.0 · 7.7 High EPSS 1.6% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift
CVE-2015-4756

mysql: unspecified vulnerability related to Server:InnoDB (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-0439.

CVSS 2.0 · 4.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Enterprise Linux Rhel Software Collections
CVE-2015-4695

libwmf: heap buffer overread in meta.h

meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.

CVSS 2.0 · 5.0 Medium EPSS 6.6% KEV · Not listed
Vendors
Redhat Wvware
Products
Enterprise Linux Libwmf
CVE-2014-3472

Security: Invalid EJB caller role check implementation

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVSS 2.0 · 4.9 Medium EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Enterprise Application Platform and 2 more
CVE-2015-0406

JDK: unspecified vulnerability fixed in 6u91, 7u75 and 8u31 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment.

CVSS 2.0 · 5.8 Medium EPSS 3.9% KEV · Not listed
Vendors
Novell Oracle Redhat
Products
Suse Linux Enterprise Desktop Jdk Jre and 3 more
CVE-2014-0195

openssl: Buffer overflow via DTLS invalid fragment

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

CVSS 2.0 · 6.8 Medium EPSS 100.0% KEV · Not listed
Vendors
Fedoraproject Mariadb Openssl and 2 more
Products
Fedora Mariadb Openssl and 4 more
CVE-2016-1674

chromium-browser: cross-origin bypass in extensions

The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Chrome Leap and 6 more
CVE-2014-7827

Security: Wrong security context loaded when using SAML2 STS Login Module

The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.

CVSS 2.0 · 3.5 Low EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Enterprise Application Platform
CVE-2016-2110

samba: Man-in-the-middle attacks possible with NTLMSSP authentication

The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security.

CVSS 3.0 · 5.9 Medium EPSS 8.3% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Rhel Aus and 5 more
CVE-2015-4487

Mozilla: Vulnerabilities found through code inspection (MFSA 2015-90)

The nsTSubstring::ReplacePrep function in Mozilla Firefox before 40.0, Firefox ESR 38.x before 38.2, and Firefox OS before 2.2 might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, related to an "overflow."

CVSS 2.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Firefox Os and 3 more
CVE-2014-7899

chromium-browser: Address bar spoofing

Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string.

CVSS 2.0 · 5.0 Medium EPSS 1.3% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2016-2089

jasper: matrix rows_ NULL pointer dereference in jas_matrix_clip()

The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image.

CVSS 3.0 · 6.5 Medium EPSS 3.0% KEV · Not listed
Vendors
Jasper Project Redhat
Products
Jasper Enterprise Linux
CVE-2014-7907

chromium-browser: Use-after-free in blink

Multiple use-after-free vulnerabilities in modules/screen_orientation/ScreenOrientationController.cpp in Blink, as used in Google Chrome before 39.0.2171.65, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger improper handling of a detached frame, related to the (1) lock and (2) unlock methods.

CVSS 2.0 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2014-6530

mysql: unspecified vulnerability related to CLIENT:MYSQLDUMP (CPU October 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to CLIENT:MYSQLDUMP.

CVSS 2.0 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Mariadb Oracle Redhat and 1 more
Products
Mariadb Mysql Solaris and 7 more
CVE-2014-7924

chromium-browser: use-after-free in IndexedDB

Use-after-free vulnerability in the IndexedDB implementation in Google Chrome before 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering duplicate BLOB references, related to content/browser/indexed_db/indexed_db_callbacks.cc and content/browser/indexed_db/indexed_db_dispatcher_host.cc.

CVSS 2.0 · 5.0 Medium EPSS 1.7% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras