Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,218

Export CSV
CVE-2013-4222

OpenStack: Keystone disabling a tenant does not disable a user token

OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.

CVSS 2.0 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Fedoraproject Openstack and 1 more
Products
Ubuntu Linux Fedora Keystone and 1 more
CVE-2010-4655

kernel: heap contents leak for CAP_NET_ADMIN via ethtool ioctl

net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability for an ethtool ioctl call.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat and 1 more
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 2 more
CVE-2013-4202

OpenStack: Cinder Denial of Service using XML entities

The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Canonical Openstack Redhat
Products
Ubuntu Linux Cinder Openstack
CVE-2013-4130

spice: unsafe clients ring access abort

The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.

CVSS 2.0 · 5.0 Medium EPSS 2.6% KEV · Not listed
Vendors
Canonical Redhat Spice Project
Products
Ubuntu Linux Enterprise Linux Spice
CVE-2013-4124

samba: DoS via integer overflow when reading an EA list

Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet.

CVSS 2.0 · 5.0 Medium EPSS 69.0% KEV · Not listed
Vendors
Canonical Fedoraproject Opensuse and 2 more
Products
Ubuntu Linux Fedora Opensuse and 2 more
CVE-2013-4002

OpenJDK: XML parsing Denial of Service (JAXP, 8017298)

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.

CVSS 2.0 · 7.1 High EPSS 24.7% KEV · Not listed
Vendors
Apache Canonical Hp and 7 more
Products
Xerces2 Java Ubuntu Linux Hp-ux and 28 more
CVE-2013-3839

mysql: unspecified DoS related to Optimizer (CPU October 2013)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.70 and earlier, 5.5.32 and earlier, and 5.6.12 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 6 more
CVE-2013-3812

mysql: unspecified DoS related to Server Replication (CPU July 2013)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Replication.

CVSS 2.0 · 3.5 Low EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 6 more
CVE-2013-3809

mysql: unspecified integrity issue related to audit log (CPU July 2013)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Audit Log.

CVSS 2.0 · 4.0 Medium EPSS 2.7% KEV · Not listed
Vendors
Canonical Mariadb Opensuse and 2 more
Products
Ubuntu Linux Mariadb Opensuse and 5 more
CVE-2013-3804

mysql: unspecified DoS related to Server Optimizer (CPU July 2013)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Mariadb and 4 more
Products
Ubuntu Linux Debian Linux Mariadb and 6 more
CVE-2010-4253

OpenOffice.org: heap based buffer overflow in PPT import

Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file in an ODF or Microsoft Office document, as demonstrated by a PowerPoint (aka PPT) document.

CVSS 2.0 · 9.3 Critical EPSS 10.1% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Openoffice Ubuntu Linux Debian Linux and 1 more
CVE-2010-4180

openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG ciphersuite downgrade attack

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.

CVSS 2.0 · 4.3 Medium EPSS 9.5% KEV · Not listed
Vendors
Canonical Debian F5 and 5 more
Products
Ubuntu Linux Debian Linux Nginx and 8 more
CVE-2002-2443

krb5: UDP ping-pong flaw in kpasswd

schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.

CVSS 2.0 · 5.0 Medium EPSS 6.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2013-3802

mysql: unspecified DoS related to Full Text Search (CPU July 2013)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Full Text Search.

CVSS 2.0 · 4.0 Medium EPSS 3.3% KEV · Not listed
Vendors
Canonical Debian Mariadb and 4 more
Products
Ubuntu Linux Debian Linux Mariadb and 6 more
CVE-2013-3793

mysql: unspecified DoS related to Data Manipulation Language (CPU July 2013)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language.

CVSS 2.0 · 4.0 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 6 more
CVE-2013-3783

mysql: unspecified DoS related to Server Parser (CPU July 2013)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.31 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Parser.

CVSS 2.0 · 4.0 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 5 more
CVE-2013-3567

puppet: remote code execution on master from unauthenticated clients

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

CVSS 2.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Canonical Novell Puppet and 2 more
Products
Ubuntu Linux Suse Linux Enterprise Desktop Suse Linux Enterprise Server and 4 more
CVE-2010-4008

libxml2: Crash (stack frame overflow or NULL pointer dereference) by traversal of XPath axis

libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.

CVSS 2.0 · 4.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Apache Apple Canonical and 6 more
Products
Openoffice Iphone Os Itunes and 13 more
CVE-2010-3861

kernel: heap contents leak from ETHTOOL_GRXCLSRLALL

The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize a certain block of heap memory, which allows local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value, a different vulnerability than CVE-2010-2478.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Opensuse and 2 more
Products
Ubuntu Linux Linux Kernel Opensuse and 5 more
CVE-2013-2852

kernel: b43: format string leaking into error msgs

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message.

CVSS 2.0 · 6.9 Medium EPSS 1.0% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 4 more