Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,244

Export CSV
CVE-2024-27008

drm: nv04: Fix out of bounds access

In the Linux kernel, the following vulnerability has been resolved: drm: nv04: Fix out of bounds access When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value. Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 1 more
CVE-2024-49369

Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted cluster nodes as well as any API users that use TLS client certificates for authentication (ApiUser objects with the client_cn attribute set). This vulnerability has been fixed in v2.14.3, v2.13.10, v2.12.11, and v2.11.12.

CVSS 3.1 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Debian Icinga
Products
Debian Linux Icinga Icinga Web 2
CVE-2016-9895

Mozilla: CSP bypass using marquee tag (MFSA 2016-94, MFSA 2016-95)

Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVSS 3.0 · 6.1 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2016-5297

Mozilla: Incorrect argument length checking in Javascript (MFSA 2016-89, MFSA 2016-90)

An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

CVSS 3.0 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 1 more
CVE-2016-9893

Mozilla: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6 (MFSA 2016-95)

Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVSS 3.0 · 9.8 Critical EPSS 2.6% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2014-1490

nss: TOCTOU, potential use-after-free in libssl's session ticket processing (MFSA 2014-12)

Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.

CVSS 2.0 · 9.3 Critical EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2014-1487

Mozilla: Cross-origin information leak through web workers (MFSA 2014-09)

The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2014-1486

Mozilla: Use-after-free with imgRequestProxy and image proccessing (MFSA 2014-08)

Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values for image data.

CVSS 3.1 · 9.8 Critical EPSS 7.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 14 more
CVE-2014-1482

Mozilla: Incorrect use of discarded images by RasterImage (MFSA 2014-04)

RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect write operations) via crafted image data, as demonstrated by Goo Create.

CVSS 3.1 · 8.8 High EPSS 6.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2014-1481

Mozilla: Inconsistent JavaScript handling of access to Window objects (MFSA 2014-13)

Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines.

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2014-1479

Mozilla: Clone protected content with XBL scopes (MFSA 2014-02)

The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2014-1477

Mozilla: Miscellaneous memory safety hazards (rv:24.3) (MFSA 2014-01)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 3.1 · 9.8 Critical EPSS 5.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2016-10196

libevent: Stack-buffer overflow in evutil_parse_sockaddr_port()

Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.

CVSS 3.1 · 7.5 High EPSS 5.2% KEV · Not listed
Vendors
Debian Libevent Project Mozilla and 1 more
Products
Debian Linux Libevent Firefox and 2 more
CVE-2016-9900

Mozilla: Restricted external resources can be loaded by SVG images through data URLs (MFSA 2016-94, MFSA 2016-95)

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVSS 3.0 · 7.5 High EPSS 9.6% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 6 more
CVE-2013-6629

libjpeg: information leak (read of uninitialized memory)

The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.

CVSS 2.0 · 5.0 Medium EPSS 9.7% KEV · Not listed
Vendors
Artifex Canonical Debian and 7 more
Products
Gpl Ghostscript Ubuntu Linux Debian Linux and 12 more
CVE-2016-9904

Mozilla: Cross-origin information leak in shared atoms (MFSA 2016-94, MFSA 2016-95)

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 4 more
CVE-2016-5291

Mozilla: Same-origin policy violation using local HTML file and saved shortcut file (MFSA 2016-89, MFSA 2016-90)

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 1 more
CVE-2016-5290

Mozilla: Memory safety bugs fixed in Firefox 45.5 (MFSA 2016-90)

Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Thunderbird and 1 more