Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2014-6568

mysql: unspecified vulnerability related to Server:InnoDB:DML (CPU Jan 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DML.

CVSS 2.0 · 3.5 Low EPSS 7.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 16 more
CVE-2014-3181

Kernel: HID: OOB write in magicmouse driver

Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg
CVE-2014-5119

glibc: off-by-one error leading to a heap-based buffer overflow flaw in __gconv_translit_find()

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.

CVSS 2.0 · 7.5 High EPSS 17.0% KEV · Not listed
Vendors
Debian Gnu Redhat
Products
Debian Linux Glibc Enterprise Linux and 2 more
CVE-2014-0539

flash-plugin: security protection bypass (APSB14-17)

Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0537.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Adobe Air Adobe Air Sdk Flash Player and 4 more
CVE-2014-3189

chromium: OOB reads in PDFium fixed in Chrome 38.0.2125.101

The chrome_pdf::CopyImage function in pdf/draw_utils.cc in the PDFium component in Google Chrome before 38.0.2125.101 does not properly validate image-data dimensions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Enterprise Linux Desktop Supplementary Enterprise Linux Server Supplementary and 3 more
CVE-2015-3137

flash-plugin: multiple code execution issues fixed in APSB15-16

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.

CVSS 2.0 · 10.0 Critical EPSS 32.8% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-6769

chromium-browser: Cross-origin bypass in core

The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing.

CVSS 2.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2014-9330

libtiff: Out-of-bounds reads followed by a crash in bmp2tiff

Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read.

CVSS 3.0 · 3.3 Low EPSS 4.1% KEV · Not listed
Vendors
Libtiff Redhat
Products
Libtiff Enterprise Linux
CVE-2014-6559

mysql: unspecified vulnerability related to C API SSL CERTIFICATE HANDLING (CPU October 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING.

CVSS 2.0 · 4.3 Medium EPSS 4.7% KEV · Not listed
Vendors
Juniper Mariadb Oracle and 2 more
Products
Junos Space Mariadb Mysql and 8 more
CVE-2014-3678

jenkins: cross-site scripting flaws in the monitoring plug-in (SECURITY-113)

Cross-site scripting (XSS) vulnerability in the Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Jenkins-ci Redhat
Products
Monitoring Plugin Openshift
CVE-2014-6591

ICU: font parsing OOB read (OpenJDK 2D, 8056276)

Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6585.

CVSS 2.0 · 2.6 Low EPSS 4.0% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-1848

pcs: improper web session variable signing

The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.

CVSS 2.0 · 6.8 Medium EPSS 2.4% KEV · Not listed
Vendors
Fedora Redhat
Products
Pacemaker Configuration System Enterprise Linux Enterprise Linux High Availability and 3 more
CVE-2014-2038

kernel: nfs: data leak during extended writes

The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux
CVE-2015-1245

chromium-browser: Use-after-free in PDFium

Use-after-free vulnerability in the OpenPDFInReaderView::Update function in browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allow user-assisted remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering interaction with a PDFium "Open PDF in Reader" button that has an invalid tab association.

CVSS 2.0 · 6.8 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2014-1569

nss: QuickDER decoder length issue

The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.

CVSS 2.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Mozilla Redhat
Products
Network Security Services Enterprise Linux
CVE-2014-3669

php: integer overflow in unserialize()

Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function that triggers calculation of a large length value.

CVSS 2.0 · 7.5 High EPSS 28.9% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Eus and 1 more
CVE-2014-4337

cups-filters: cups-browsed DoS via process_browse_data() OOB read

The process_browse_data function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted packet data.

CVSS 2.0 · 4.3 Medium EPSS 2.9% KEV · Not listed
Vendors
Linuxfoundation Redhat
Products
Cups-filters Enterprise Linux
CVE-2014-8578

openstack-horizon: multiple XSS flaws

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.

CVSS 2.0 · 3.5 Low EPSS 1.2% KEV · Not listed
Vendors
Openstack Redhat
Products
Horizon Openstack
CVE-2014-3668

php: xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime()

Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a crafted first argument to the xmlrpc_set_type function or (2) a crafted argument to the xmlrpc_decode function, related to an out-of-bounds read operation.

CVSS 2.0 · 5.0 Medium EPSS 27.0% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Software Collections