Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 83

Export CSV
CVE-2016-5388

Tomcat: CGI sets environmental variable based on user supplied Proxy request header

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.

CVSS 3.0 · 8.1 High EPSS 50.9% KEV · Not listed
Vendors
Apache Hp Oracle and 1 more
Products
Tomcat System Management Homepage Linux and 10 more
CVE-2016-3718

ImageMagick: SSRF vulnerability

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

CVSS 3.1 · 5.5 Medium EPSS 75.6% KEV · Listed
Vendors
Canonical Imagemagick Opensuse and 3 more
Products
Ubuntu Linux Imagemagick Leap and 28 more
CVE-2015-5300

ntp: MITM attacker can force ntpd to make a step larger than the panic threshold

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).

CVSS 3.0 · 7.5 High EPSS 9.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2015-3315

abrt: Various race-conditions and symlink issues found in abrt

Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files via a symlink attack on (1) /var/tmp/abrt/*/maps, (2) /tmp/jvm-*/hs_error.log, (3) /proc/*/exe, (4) /etc/os-release in a chroot, or (5) an unspecified root directory related to librpm.

CVSS 3.0 · 7.8 High EPSS 4.8% KEV · Not listed
Vendors
Redhat
Products
Automatic Bug Reporting Tool Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2014-9666

freetype: integer overflow in tt_sbit_decoder_init() leading to out-of-bounds read

The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap.

CVSS 2.0 · 6.8 Medium EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2014-9664

freetype: off-by-one buffer over-read in parse_charstrings() / t42_parse_charstrings()

FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c.

CVSS 2.0 · 6.8 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2014-9660

freetype: missing ENDCHAR NULL pointer dereference in the _bdf_parse_glyphs()

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2014-9671

freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.

CVSS 2.0 · 4.3 Medium EPSS 3.5% KEV · Not listed
Vendors
Canonical Debian Freetype and 3 more
Products
Ubuntu Linux Debian Linux Freetype and 9 more
CVE-2014-9673

freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow

Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

CVSS 2.0 · 6.8 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Freetype and 2 more
Products
Ubuntu Linux Debian Linux Freetype and 8 more
CVE-2014-9674

freetype: multiple integer overflows Mac_Read_POST_Resource() leading to heap-based buffer overflows

The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

CVSS 2.0 · 7.5 High EPSS 5.7% KEV · Not listed
Vendors
Canonical Fedoraproject Freetype and 3 more
Products
Ubuntu Linux Fedora Freetype and 9 more
CVE-2014-9675

freetype: information leak in _bdf_add_property()

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.

CVSS 2.0 · 5.0 Medium EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2015-1863

wpa_supplicant: P2P SSID processing vulnerability

Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.

CVSS 2.0 · 5.8 Medium EPSS 5.2% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Opensuse and 8 more
CVE-2014-9670

freetype: integer overflow in pcf_get_encodings() leading to NULL pointer dereference

Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row.

CVSS 2.0 · 4.3 Medium EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2014-9663

freetype: out-of-bounds read in tt_cmap4_validate()

The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2015-2787

php: use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.

CVSS 2.0 · 7.5 High EPSS 11.8% KEV · Not listed
Vendors
Apple Opensuse Php and 1 more
Products
Mac Os X Opensuse Php and 8 more
CVE-2015-2783

php: buffer over-read in Phar metadata parsing

ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.

CVSS 2.0 · 5.8 Medium EPSS 9.0% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2014-9669

freetype: multiple integer overflows leading to buffer over-reads in cmap handling

Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table.

CVSS 2.0 · 6.8 Medium EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2015-2348

php: move_uploaded_file() NUL byte injection in file name

The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 5.0 Medium EPSS 8.3% KEV · Not listed
Vendors
Apple Opensuse Php and 1 more
Products
Mac Os X Opensuse Php and 8 more