Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26,253

Export CSV
CVE-2015-3126

flash-plugin: multiple code execution issues fixed in APSB15-16

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-4429.

CVSS 2.0 · 7.5 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-3127

flash-plugin: multiple code execution issues fixed in APSB15-16

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.

CVSS 2.0 · 10.0 Critical EPSS 6.7% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-3133

flash-plugin: multiple code execution issues fixed in APSB15-16

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3134, and CVE-2015-4431.

CVSS 2.0 · 10.0 Critical EPSS 5.3% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-3134

flash-plugin: multiple code execution issues fixed in APSB15-16

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, and CVE-2015-4431.

CVSS 2.0 · 10.0 Critical EPSS 26.5% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-3135

flash-plugin: multiple code execution issues fixed in APSB15-16

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4432 and CVE-2015-5118.

CVSS 2.0 · 10.0 Critical EPSS 8.2% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-3136

flash-plugin: multiple code execution issues fixed in APSB15-16

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.

CVSS 2.0 · 10.0 Critical EPSS 6.7% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-3137

flash-plugin: multiple code execution issues fixed in APSB15-16

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.

CVSS 2.0 · 10.0 Critical EPSS 32.8% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-3290

kernel: x86: nested NMI handler and espfix64 interaction privilege escalation

arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.

CVSS 2.0 · 7.2 High EPSS 1.1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2015-3291

kernel: x86/nmi: malicious userspace programs can cause the kernel to skip NMIs

arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly determine when nested NMI processing is occurring, which allows local users to cause a denial of service (skipped NMI) by modifying the rsp register, issuing a syscall instruction, and triggering an NMI.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2015-3331

Kernel: crypto: buffer overruns in RFC4106 implementation using AESNI

The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket.

CVSS 2.0 · 9.3 Critical EPSS 10.7% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 4 more
CVE-2015-3332

kernel: TCP Fast Open local DoS

A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux
Products
Debian Linux Linux Kernel
CVE-2015-3636

kernel: ping sockets: use-after-free leading to local privilege escalation

The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.

CVSS 2.0 · 4.9 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 5 more
CVE-2015-4036

kernel: potential memory corruption (denial of service) in vhost/scsi driver

Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2015-4167

Kernel: fs: udf: Check length of extended attributes to avoid oops

The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain length values, which allows local users to cause a denial of service (incorrect data representation or integer overflow, and OOPS) via a crafted UDF filesystem.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux
Products
Ubuntu Linux Debian Linux Linux Kernel
CVE-2015-4170

kernel: pty layer race condition on tty ldisc shutdown.

Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsem_down_read and ldsem_down_write deadlock) by establishing a new tty thread during shutdown of a previous tty thread.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Compute Node Eus and 6 more
CVE-2015-4433

flash-plugin: multiple code execution issues fixed in APSB15-16

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, and CVE-2015-3122.

CVSS 2.0 · 10.0 Critical EPSS 6.7% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-4512

Mozilla: Out-of-bounds read during 2D canvas display on Linux 16-bit color depth systems (MFSA 2015-107)

gfx/2d/DataSurfaceHelpers.cpp in Mozilla Firefox before 41.0 on Linux improperly attempts to use the Cairo library with 32-bit color-depth surface creation followed by 16-bit color-depth surface display, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) by using a CANVAS element to trigger 2D rendering.

CVSS 2.0 · 6.4 Medium EPSS 2.9% KEV · Not listed
Vendors
Linux Mozilla
Products
Linux Kernel Firefox
CVE-2015-5116

flash-plugin: information disclosure issues fixed in APSB15-16

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, and CVE-2015-3125.

CVSS 2.0 · 5.0 Medium EPSS 22.5% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-5117

flash-plugin: multiple code execution issues fixed in APSB15-16

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, and CVE-2015-4430.

CVSS 2.0 · 10.0 Critical EPSS 6.7% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2015-5118

flash-plugin: multiple code execution issues fixed in APSB15-16

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3135 and CVE-2015-4432.

CVSS 2.0 · 10.0 Critical EPSS 27.7% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more