Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,351

Export CSV
CVE-2012-3489

postgresql: File disclosure through XXE in xmlparse by DTD validation

The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.

CVSS 3.1 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Mac Os X Server Ubuntu Linux Debian Linux and 7 more
CVE-2014-0386

mysql: unspecified vulnerability related to Optimizer DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2014-0393

mysql: unspecified vulnerability related to InnoDB affecting integrity (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect integrity via unknown vectors related to InnoDB.

CVSS 2.0 · 3.3 Low EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2014-0401

mysql: unspecified DoS vulnerability (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors.

CVSS 2.0 · 4.0 Medium EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2014-0402

mysql: unspecified vulnerability related to Locking DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Locking.

CVSS 2.0 · 4.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2014-0412

mysql: unspecified vulnerability related to InnoDB DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

CVSS 2.0 · 4.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2014-0420

mysql: unspecified vulnerability related to Replication DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.34 and earlier, and 5.6.14 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Replication.

CVSS 2.0 · 2.8 Low EPSS 3.7% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 7 more
CVE-2014-0437

mysql: unspecified vulnerability related to Optimizer DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVSS 2.0 · 3.5 Low EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2012-3412

kernel: sfc: potential remote denial of service through TCP MSS option

The sfc (aka Solarflare Solarstorm) driver in the Linux kernel before 3.2.30 allows remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value.

CVSS 2.0 · 7.8 High EPSS 5.9% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 1 more
CVE-2012-3406

glibc: printf() unbound alloca() usage in case of positional parameters + many format specs

The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.

CVSS 2.0 · 6.8 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Gnu Redhat
Products
Ubuntu Linux Glibc Enterprise Linux and 1 more
CVE-2012-5843

Mozilla: Miscellaneous memory safety hazards (rv:17.0) (MFSA 2012-91)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 5.8% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Seamonkey and 6 more
CVE-2012-3405

glibc: incorrect use of extend_alloca() in formatted printing can lead to FORTIFY_SOURCE format string protection bypass

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (segmentation fault and crash) via a format string with a large number of format specifiers that triggers "desynchronization within the buffer size handling," a different vulnerability than CVE-2012-3404.

CVSS 2.0 · 5.0 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Gnu Redhat
Products
Ubuntu Linux Glibc Enterprise Linux and 1 more
CVE-2012-3400

kernel: udf: buffer overflow when parsing sparing table

Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.

CVSS 2.0 · 7.6 High EPSS 7.8% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 1 more
CVE-2002-2443

krb5: UDP ping-pong flaw in kpasswd

schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.

CVSS 2.0 · 5.0 Medium EPSS 6.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2012-3197

mysql: unspecified DoS vulnerability related to Server Replication (CPU Oct 2012)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Replication.

CVSS 2.0 · 3.5 Low EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 6 more
CVE-2013-0777

Mozilla: Use-after-free, out of bounds read, and buffer overflow issues found using Address Sanitizer (MFSA 2013-28)

Use-after-free vulnerability in the nsDisplayBoxShadowOuter::Paint function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.9% KEV · Not listed
Vendors
Canonical Mozilla Opensuse
Products
Ubuntu Linux Firefox Seamonkey and 3 more
CVE-2012-3180

mysql: unspecified DoS vulnerability related to Server Optimizer (CPU Oct 2012)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 6 more
CVE-2012-5842

Mozilla: Miscellaneous memory safety hazards (rv:10.0.11) (MFSA 2012-91)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.8% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 12 more
CVE-2012-3177

mysql: unspecified Server DoS vulnerability (CPU Oct 2012)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server.

CVSS 2.0 · 6.8 Medium EPSS 3.7% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 6 more
CVE-2012-5841

Mozilla: Improper security filtering for cross-origin wrappers (MFSA 2012-100)

Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 implement cross-origin wrappers with a filtering behavior that does not properly restrict write actions, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.

CVSS 2.0 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 2 more
Products
Ubuntu Linux Firefox Seamonkey and 11 more