Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2015-5117

flash-plugin: multiple code execution issues fixed in APSB15-16

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, and CVE-2015-4430.

CVSS 2.0 · 10.0 Critical EPSS 6.7% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-5213

libreoffice: Integer overflow in DOC files

Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a long DOC file, which triggers a buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 9.6% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Openoffice Ubuntu Linux Debian Linux and 2 more
CVE-2015-5251

openstack-glance allows illegal modification of image status

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

CVSS 2.0 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Openstack Redhat
Products
Image Registry And Delivery Service \(glance\) Openstack
CVE-2015-5286

openstack-glance: Storage overrun by deleting images

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

CVSS 2.0 · 6.8 Medium EPSS 2.5% KEV · Not listed
Vendors
Openstack Redhat
Products
Image Registry And Delivery Service \(glance\) Openstack
CVE-2015-5548

flash-plugin: multiple code execution flaws (APSB15-19)

Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.

CVSS 2.0 · 10.0 Critical EPSS 38.2% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-5549

flash-plugin: multiple code execution flaws (APSB15-19)

Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5552, and CVE-2015-5553.

CVSS 2.0 · 10.0 Critical EPSS 38.2% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-5550

flash-plugin: multiple code execution flaws (APSB15-19)

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.

CVSS 2.0 · 10.0 Critical EPSS 44.8% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-5563

flash-plugin: multiple code execution flaws (APSB15-19)

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5564, and CVE-2015-5565.

CVSS 2.0 · 10.0 Critical EPSS 45.8% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-5575

flash-plugin: multiple code execution issues fixed in APSB15-23

Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.

CVSS 2.0 · 10.0 Critical EPSS 4.0% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 6 more
CVE-2015-5963

python-django: Denial-of-service possibility in logout() view by filling session store

contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.

CVSS 2.0 · 5.0 Medium EPSS 5.2% KEV · Not listed
Vendors
Canonical Djangoproject Oracle and 1 more
Products
Ubuntu Linux Django Solaris and 1 more
CVE-2015-8818

Qemu: OOB access in address_space_rw leads to segmentation fault

The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Openstack
CVE-2015-8820

flash-plugin: multiple code execution issues fixed in APSB15-32

Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, CVE-2015-8455, CVE-2015-8652, CVE-2015-8654, CVE-2015-8656, CVE-2015-8657, and CVE-2015-8658.

CVSS 3.1 · 8.8 High EPSS 7.1% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Desktop Runtime Air Sdk and 13 more
CVE-2015-6679

flash-plugin: information leaks and hardening bypass fixed in APSB15-23

Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 5.5% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 6 more
CVE-2015-6757

chromium-browser: Use-after-free in ServiceWorker

Use-after-free vulnerability in content/browser/service_worker/embedded_worker_instance.cc in the ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a callback.

CVSS 2.0 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2015-6761

chromium-browser: Memory corruption in FFMpeg

The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.

CVSS 2.0 · 6.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Ffmpeg Google Redhat
Products
Ffmpeg Chrome Rhel Extras
CVE-2015-0283

slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()

The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request for a (1) group with a large number of members or (2) user that belongs to a large number of groups.

CVSS 2.0 · 7.8 High EPSS 3.1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Slapi-nis
CVE-2015-6774

chromium-browser: Use-after-free in Extensions

Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes_extension_bindings.cc in the Extensions implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that modifies a pointer used for reporting loadTimes data.

CVSS 2.0 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2015-6777

chromium-browser: Use-after-free in DOM

Use-after-free vulnerability in the ContainerNode::notifyNodeInsertedInternal function in WebKit/Source/core/dom/ContainerNode.cpp in the DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOMCharacterDataModified events for certain detached-subtree insertions.

CVSS 2.0 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2015-6785

chromium-browser: Wildcard matching issue in CSP

The CSPSource::hostMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accepts an x.y hostname as a match for a *.x.y pattern, which might allow remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging a policy that was intended to be specific to subdomains.

CVSS 2.0 · 4.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras