Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 52

Export CSV
CVE-2008-5021

Mozilla crash and remote code execution in nsFrameManager

nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying properties of a file input element while it is still being initialized, then using the blur method to access uninitialized memory.

CVSS 2.0 · 9.3 Critical EPSS 3.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2009-3547

kernel: fs: pipe.c null pointer dereference

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.

CVSS 3.1 · 7.0 High EPSS 4.9% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 5 more
Products
Ubuntu Linux Fedora Linux Kernel and 14 more
CVE-2007-6716

kernel: dio: zero struct dio with kzalloc instead of manually

fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service (OOPS), as demonstrated by a certain fio test.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 4 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 5 more
CVE-2008-2812

kernel: NULL ptr dereference in multiple network drivers due to missing checks in tty code

The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving NULL pointer dereference of function pointers in (1) hamradio/6pack.c, (2) hamradio/mkiss.c, (3) irda/irtty-sir.c, (4) ppp_async.c, (5) ppp_synctty.c, (6) slip.c, (7) wan/x25_asy.c, and (8) wireless/strip.c in drivers/net/.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Avaya Canonical Debian and 5 more
Products
Communication Manager Expanded Meet-me Conferencing Intuity Audix Lx and 13 more
CVE-2009-2848

kernel: execve: must clear current->clear_child_tid

The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.

CVSS 2.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 5 more
Products
Ubuntu Linux Fedora Linux Kernel and 12 more
CVE-2018-6116

chromium-browser: Incorrect low memory handling in WebAssembly

A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6108

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6107

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6105

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.0 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6104

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6103

chromium-browser: UI spoof in Permissions

A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6102

chromium-browser: URL spoof in Omnibox

Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

CVSS 3.0 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6101

chromium-browser: Insufficient protection of remote debugging prototol in DevTools

A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if the user is running a remote DevTools debugging server.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6099

chromium-browser: CORS bypass in ServiceWorker

A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6098

chromium-browser: URL spoof in Omnibox

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6095

chromium-browser: Lack of meaningful user interaction requirement before file upload

Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more
CVE-2018-6094

chromium-browser: Exploit hardening regression in Oilpan

Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Linux Desktop and 3 more