Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2014-6562

OpenJDK: incorrect handling of zip entries with NUL in name (Libraries, 8048025)

Unspecified vulnerability in Oracle Java SE 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0 · 9.3 Critical EPSS 4.8% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux
CVE-2014-8438

flash-plugin: multiple code execution flaws (APSB14-24)

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0573 and CVE-2014-0588.

CVSS 2.0 · 10.0 Critical EPSS 9.9% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-8000

bind: responses with a malformed class attribute can trigger an assertion failure in db.c

db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute.

CVSS 2.0 · 5.0 Medium EPSS 55.9% KEV · Not listed
Vendors
Isc Oracle Redhat
Products
Bind Linux Solaris and 4 more
CVE-2015-5240

openstack-neutron: Firewall rules bypass through port update

Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group rules are applied.

CVSS 2.0 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Openstack Redhat
Products
Neutron Openstack
CVE-2014-8106

qemu: cirrus: insufficient blit region checks

Heap-based buffer overflow in the Cirrus VGA emulator (hw/display/cirrus_vga.c) in QEMU before 2.2.0 allows local guest users to execute arbitrary code via vectors related to blit regions. NOTE: this vulnerability exists because an incomplete fix for CVE-2007-1320.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack
CVE-2015-8071

flash-plugin: multiple code execution issues fixed in APSB15-32

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

CVSS 2.0 · 10.0 Critical EPSS 5.8% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 7 more
CVE-2015-8043

flash-plugin: multiple code execution issues fixed in APSB15-28

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8044, and CVE-2015-8046.

CVSS 2.0 · 10.0 Critical EPSS 29.4% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 7 more
CVE-2014-8484

binutils: invalid read flaw in libbfd

The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to cause a denial of service (out-of-bounds read) via a small S-record.

CVSS 2.0 · 5.0 Medium EPSS 5.1% KEV · Not listed
Vendors
Canonical Fedoraproject Gnu and 1 more
Products
Ubuntu Linux Fedora Binutils and 1 more
CVE-2013-7347

conga: insecure handling of luci web interface sessions

Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.

CVSS 2.0 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Conga Enterprise Linux
CVE-2014-8501

binutils: out-of-bounds write when parsing specially crafted PE executable

The _bfd_XXi_swap_aouthdr_in function in bfd/peXXigen.c in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable.

CVSS 2.0 · 7.5 High EPSS 5.2% KEV · Not listed
Vendors
Canonical Fedoraproject Gnu and 1 more
Products
Ubuntu Linux Fedora Binutils and 1 more
CVE-2014-1578

Mozilla: Out-of-bounds write with WebM video (MFSA 2014-77)

The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.

CVSS 2.0 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Thunderbird Enterprise Linux
CVE-2014-3575

openoffice: Arbitrary file disclosure via crafted OLE objects

The OLE preview generation in Apache OpenOffice before 4.1.1 and OpenOffice.org (OOo) might allow remote attackers to embed arbitrary data into documents via crafted OLE objects.

CVSS 2.0 · 4.3 Medium EPSS 11.3% KEV · Not listed
Vendors
Apache Libreoffice Redhat
Products
Openoffice Libreoffice Enterprise Linux and 3 more
CVE-2014-8564

gnutls: Heap corruption when generating key ID for ECC (GNUTLS-SA-2014-5)

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

CVSS 2.0 · 5.0 Medium EPSS 3.3% KEV · Not listed
Vendors
Canonical Gnu Opensuse and 1 more
Products
Ubuntu Linux Gnutls Opensuse and 5 more
CVE-2015-2737

Mozilla: Vulnerabilities found through code inspection (MFSA 2015-66)

The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.

CVSS 2.0 · 10.0 Critical EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 8 more
CVE-2015-2741

Mozilla: Key pinning is ignored when overridable errors are encountered (MFSA 2015-67)

Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which allows user-assisted man-in-the-middle attackers to bypass intended access restrictions by triggering a (1) expired certificate or (2) mismatched hostname for a domain with pinning enabled.

CVSS 2.0 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Mozilla Oracle Redhat
Products
Firefox Firefox Esr Solaris and 1 more
CVE-2015-1842

openstack-puppet-modules: pacemaker configured with default password

The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 5.2% KEV · Not listed
Vendors
Redhat
Products
Openstack Openstack-installer
CVE-2015-8419

flash-plugin: multiple code execution issues fixed in APSB15-32

Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.

CVSS 2.0 · 10.0 Critical EPSS 6.1% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 7 more
CVE-2015-2153

tcpdump: tcp printer rpki_rtr_pdu_print() missing length check

The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU).

CVSS 2.0 · 5.0 Medium EPSS 18.5% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2015-1818

dashbuilder: XXE/SSRF vulnerability

XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.

CVSS 2.0 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpm Suite Jboss Bpms Jboss Data Virtualization