Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,413

Export CSV
CVE-2016-3500

OpenJDK: maximum XML name limit not applied to namespace URIs (JAXP, 8148872)

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3508.

CVSS 3.0 · 5.3 Medium EPSS 4.8% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Jrockit and 3 more
CVE-2016-3508

OpenJDK: missing entity replacement limits (JAXP, 8149962)

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500.

CVSS 3.0 · 5.3 Medium EPSS 4.8% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Jrockit and 3 more
CVE-2016-0751

rubygem-actionpack: possible object leak and denial of service attack in Action Pack

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.

CVSS 3.0 · 7.5 High EPSS 9.7% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Rhel Software Collections Rails Ruby On Rails
CVE-2015-7540

samba: DoS to AD-DC due to insufficient checking of asn1 memory allocation

The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successful ASN.1 memory allocation, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) via crafted packets.

CVSS 3.1 · 7.5 High EPSS 7.1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 2 more
CVE-2016-6515

openssh: Denial of service via very long passwords

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.

CVSS 3.0 · 7.5 High EPSS 58.6% KEV · Not listed
Vendors
Fedoraproject Openbsd Redhat
Products
Fedora Openssh Enterprise Linux
CVE-2016-8576

Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch

The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Qemu and 1 more
Products
Debian Linux Leap Qemu and 3 more
CVE-2014-3696

pidgin: denial of service parsing Groupwise server message

nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server message that triggers a large memory allocation.

CVSS 3.0 · 4.3 Medium EPSS 2.9% KEV · Not listed
Vendors
Pidgin Redhat
Products
Pidgin Enterprise Linux
CVE-2014-0109

CXF: HTML content posted to SOAP endpoint could cause OOM errors

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.

CVSS 2.0 · 4.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2014-7300

gnome-shell: lockscreen bypass with printscreen key

GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Gnome-shell Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2016-8740

httpd: Incomplete handling of LimitRequestFields directive in mod_http2

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

CVSS 3.0 · 7.5 High EPSS 79.1% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Jboss Core Services Rhel Software Collections
CVE-2016-6213

kernel: Overflowing kernel mount table using shared bind mount

fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Extras Rt
CVE-2015-5262

httpcomponents-core: missing HTTPS connection timeout

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 18.8% KEV · Not listed
Vendors
Apache Canonical Fedoraproject
Products
Httpclient Ubuntu Linux Fedora
CVE-2015-1779

qemu: vnc: insufficient resource limiting in VNC websockets decoder

The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.

CVSS 3.1 · 8.6 High EPSS 6.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2014-8158

jasper: unrestricted stack memory use in jpc_qmfb.c (oCERT-2015-001)

Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.

CVSS 2.0 · 6.8 Medium EPSS 14.4% KEV · Not listed
Vendors
Debian Jasper Project Opensuse and 1 more
Products
Debian Linux Jasper Opensuse and 2 more
CVE-2014-9601

python-pillow: potential denial-of-service during PNG decompression

Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.

CVSS 2.0 · 5.0 Medium EPSS 4.7% KEV · Not listed
Vendors
Fedoraproject Opensuse Oracle and 1 more
Products
Fedora Opensuse Solaris and 1 more
CVE-2014-9620

file: limit the number of ELF notes processed

The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large number of notes.

CVSS 2.0 · 5.0 Medium EPSS 4.7% KEV · Not listed
Vendors
File Project Redhat
Products
File Enterprise Linux
CVE-2014-9621

file: limit string printing to 100 chars

The ELF parser in file 5.16 through 5.21 allows remote attackers to cause a denial of service via a long string.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed
Vendors
File Project
Products
File
CVE-2015-7581

rubygem-actionpack: Object leak vulnerability for wildcard controller routes in Action Pack

actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.

CVSS 3.0 · 7.5 High EPSS 6.7% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Rhel Software Collections Rails
CVE-2015-0202

subversion: (mod_dav_svn) remote denial of service with certain REPORT requests

The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which trigger the traversal of FSFS repository nodes.

CVSS 2.0 · 7.8 High EPSS 8.0% KEV · Not listed
Vendors
Apache Opensuse
Products
Subversion Opensuse