Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,046

Export CSV
CVE-2009-0519

flash-plugin: Input validation flaw (DoS)

Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a crafted Shockwave Flash (aka .swf) file.

CVSS 2.0 · 9.3 Critical EPSS 14.8% KEV · Not listed
Vendors
Adobe Redhat
Products
Air Flash Player Flash Player For Linux and 2 more
CVE-2009-0512

acroread: multiple security fixes in version 8.1.6 (APSB09-07)

Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0888, and CVE-2009-0889.

CVSS 2.0 · 9.3 Critical EPSS 10.9% KEV · Not listed
Vendors
Adobe Redhat
Products
Acrobat Acrobat Reader Rhel Extras
CVE-2008-0657

java-1.5.0 Privilege escalation via unstrusted applet and application

Multiple unspecified vulnerabilities in the Java Runtime Environment in Sun JDK and JRE 6 Update 1 and earlier, and 5.0 Update 13 and earlier, allow context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.

CVSS 2.0 · 10.0 Critical EPSS 2.8% KEV · Not listed
Vendors
Redhat Sun
Products
Network Satellite Rhel Extras Jdk and 1 more
CVE-2009-0511

acroread: multiple security fixes in version 8.1.6 (APSB09-07)

Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0512, CVE-2009-0888, and CVE-2009-0889.

CVSS 2.0 · 9.3 Critical EPSS 10.9% KEV · Not listed
Vendors
Adobe Redhat
Products
Acrobat Acrobat Reader Rhel Extras
CVE-2009-0510

acroread: multiple security fixes in version 8.1.6 (APSB09-07)

Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0511, CVE-2009-0512, CVE-2009-0888, and CVE-2009-0889.

CVSS 2.0 · 9.3 Critical EPSS 10.9% KEV · Not listed
Vendors
Adobe Redhat
Products
Acrobat Acrobat Reader Rhel Extras
CVE-2007-0044

Acrobat Reader Universal CSRF and session riding

Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."

CVSS 2.0 · 4.3 Medium EPSS 56.8% KEV · Not listed
Vendors
Adobe Redhat
Products
Acrobat Acrobat 3d Acrobat Reader and 1 more
CVE-2009-0509

acroread: multiple security fixes in version 8.1.6 (APSB09-07)

Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allows remote attackers to execute arbitrary code via a crafted file that triggers memory corruption.

CVSS 2.0 · 9.3 Critical EPSS 8.8% KEV · Not listed
Vendors
Adobe Redhat
Products
Acrobat Acrobat Reader Rhel Extras
CVE-2009-0217

xml-security-1.3.0-1jpp.ep1.*: XMLDsig HMAC-based signatures spoofing and authentication bypass

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.

CVSS 2.0 · 5.0 Medium EPSS 6.4% KEV · Not listed
Vendors
Ibm Mono Project Oracle and 1 more
Products
Websphere Application Server Mono Application Server and 6 more
CVE-2008-0628

java-1.6.0 default external entity processing

The XML parsing code in Sun Java Runtime Environment JDK and JRE 6 Update 3 and earlier processes external entity references even when the "external general entities" property is false, which allows remote attackers to conduct XML external entity (XXE) attacks and cause a denial of service or access restricted resources.

CVSS 2.0 · 7.8 High EPSS 3.4% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre
CVE-2009-0198

acroread: multiple security fixes in version 8.1.6 (APSB09-07)

Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF file that contains JBIG2 text region segments with Huffman encoding.

CVSS 2.0 · 9.3 Critical EPSS 8.8% KEV · Not listed
Vendors
Adobe Redhat
Products
Acrobat Acrobat Reader Rhel Extras
CVE-2009-0193

acroread: multiple JBIG2-related security flaws

Heap-based buffer overflow in Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a PDF file with a malformed JBIG2 symbol dictionary segment, a different vulnerability than CVE-2009-1061 and CVE-2009-1062.

CVSS 2.0 · 9.3 Critical EPSS 9.6% KEV · Not listed
Vendors
Adobe Redhat
Products
Acrobat Reader Rhel Extras
CVE-2007-6637

Flash Player content injection flaw

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by CVE-2007-6244.1.

CVSS 2.0 · 4.3 Medium EPSS 4.9% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Rhel Extras
CVE-2006-6745

security flaw

Multiple unspecified vulnerabilities in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 7 and earlier, and Java System Development Kit (SDK) and JRE 1.4.2_12 and earlier 1.4.x versions, allow attackers to develop Java applets or applications that are able to gain privileges, related to serialization in JRE.

CVSS 2.0 · 9.3 Critical EPSS 3.2% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras J2se Jre
CVE-2008-5499

flash-plugin: Linux-specific code execution flaw via crafted SWF file

Unspecified vulnerability in Adobe Flash Player for Linux 10.0.12.36, and 9.0.151.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file.

CVSS 2.0 · 9.3 Critical EPSS 79.4% KEV · Not listed
Vendors
Adobe Linux Redhat
Products
Flash Player For Linux Linux Kernel Rhel Extras
CVE-2008-5363

security flaw

The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file.

CVSS 2.0 · 4.3 Medium EPSS 3.7% KEV · Not listed
Vendors
Adobe Redhat
Products
Air Flash Player Rhel Extras
CVE-2007-6246

flash: privilege escalation

Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for memory, which might allow local users to gain privileges.

CVSS 2.0 · 4.4 Medium EPSS 11.8% KEV · Not listed
Vendors
Adobe Linux Redhat
Products
Flash Player Linux Kernel Rhel Extras
CVE-2008-5362

security flaw

The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file.

CVSS 2.0 · 4.3 Medium EPSS 3.8% KEV · Not listed
Vendors
Adobe Redhat
Products
Air Flash Player Rhel Extras
CVE-2008-5361

security flaw

The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not verify a member element's size when performing (1) DefineConstantPool, (2) ActionJump, (3) ActionPush, (4) ActionTry, and unspecified other actions, which allows remote attackers to read sensitive data from process memory via a crafted PDF file.

CVSS 2.0 · 4.3 Medium EPSS 3.8% KEV · Not listed
Vendors
Adobe Redhat
Products
Air Flash Player Rhel Extras
CVE-2007-6245

flash: HTTP headers modification

Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 allows remote attackers to modify HTTP headers for client requests and conduct HTTP Request Splitting attacks.

CVSS 2.0 · 5.8 Medium EPSS 4.7% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Rhel Extras
CVE-2006-6737

security flaw

Unspecified vulnerability in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 5 and earlier, Java System Development Kit (SDK) and JRE 1.4.2_10 and earlier 1.4.x versions, and SDK and JRE 1.3.1_18 and earlier allows attackers to use untrusted applets to "access data in other applets," aka "The first issue."

CVSS 2.0 · 4.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Rhel Extras Jdk and 2 more