Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,088

Export CSV
CVE-2007-0556

security flaw

The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an "ALTER COLUMN TYPE" SQL statement, which can be leveraged to read arbitrary memory from the server.

CVSS 2.0 · 6.6 Medium EPSS 3.1% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Enterprise Linux Rhel Application Stack
CVE-2007-0720

security flaw

The CUPS service on multiple platforms allows remote attackers to cause a denial of service (service hang) via a "partially-negotiated" SSL connection, which prevents other requests from being accepted.

CVSS 2.0 · 5.0 Medium EPSS 5.5% KEV · Not listed
Vendors
Apple Cups Redhat
Products
Mac Os X Cups Enterprise Linux
CVE-2007-0771

Tracing execution of a threaded executable causes kernel BUG report

The utrace support in Linux kernel 2.6.18, and other versions, allows local users to cause a denial of service (system hang) related to "MT exec + utrace_attach spin failure mode," as demonstrated by ptrace-thrash.c.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2007-0773

lost fput in a 32-bit ioctl on 64-bit x86 systems

The Linux kernel before 2.6.9-42.0.8 in Red Hat 4.4 allows local users to cause a denial of service (kernel OOPS from null dereference) via fput in a 32-bit ioctl on 64-bit x86 systems, an incomplete fix of CVE-2005-3044.1.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Desktop
CVE-2007-0775

security flaw

Multiple unspecified vulnerabilities in the layout engine in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, and SeaMonkey before 1.0.8 allow remote attackers to cause a denial of service (crash) and potentially execute arbitrary code via certain vectors.

CVSS 2.0 · 3.7 Low EPSS 1.1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Thunderbird and 1 more
CVE-2007-0777

security flaw

The JavaScript engine in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, and SeaMonkey before 1.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain vectors that trigger memory corruption.

CVSS 2.0 · 9.3 Critical EPSS 7.6% KEV · Not listed
Vendors
Canonical Mozilla Redhat
Products
Ubuntu Linux Firefox Seamonkey and 2 more
CVE-2007-0778

security flaw

The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to the wrong page cache, which allows remote attackers to obtain sensitive information or enable further attack vectors when the target page is reloaded from the cache.

CVSS 2.0 · 5.4 Medium EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Mozilla and 1 more
Products
Ubuntu Linux Debian Linux Firefox and 2 more
CVE-2007-0779

security flaw

GUI overlay vulnerability in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 allows remote attackers to spoof certain user interface elements, such as the host name or security indicators, via the CSS3 hotspot property with a large, transparent, custom cursor.

CVSS 2.0 · 6.4 Medium EPSS 1.6% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Enterprise Linux
CVE-2007-0780

security flaw

browser.js in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 uses the requesting URI to identify child windows, which allows remote attackers to conduct cross-site scripting (XSS) attacks by opening a blocked popup originating from a javascript: URI in combination with multiple frames having the same data: URI.

CVSS 2.0 · 6.8 Medium EPSS 2.6% KEV · Not listed
Vendors
Canonical Mozilla Redhat
Products
Ubuntu Linux Firefox Seamonkey and 1 more
CVE-2007-0800

security flaw

Cross-zone vulnerability in Mozilla Firefox 1.5.0.9 considers blocked popups to have an internal zone origin, which allows user-assisted remote attackers to cross zone restrictions and read arbitrary file:// URIs by convincing a user to show a blocked popup.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Enterprise Linux
CVE-2007-0906

security flaw

Multiple buffer overflows in PHP before 5.2.1 allow attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors in the (1) session, (2) zip, (3) imap, and (4) sqlite extensions; (5) stream filters; and the (6) str_replace, (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and (10) ibase_modify_user functions. NOTE: vector 6 might actually be an integer overflow (CVE-2007-1885). NOTE: as of 20070411, vector (3) might involve the imap_mail_compose function (CVE-2007-1825).

CVSS 2.0 · 7.5 High EPSS 5.7% KEV · Not listed
Vendors
Php Redhat Trustix
Products
Php Enterprise Linux Rhel Application Stack and 2 more
CVE-2007-0908

security flaw

The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.

CVSS 2.0 · 5.0 Medium EPSS 12.5% KEV · Not listed
Vendors
Canonical Php Redhat
Products
Ubuntu Linux Php Enterprise Linux and 2 more
CVE-2007-0909

security flaw

Multiple format string vulnerabilities in PHP before 5.2.1 might allow attackers to execute arbitrary code via format string specifiers to (1) all of the *print functions on 64-bit systems, and (2) the odbc_result_all function.

CVSS 2.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Php Redhat Trustix
Products
Php Enterprise Linux Rhel Application Stack and 2 more
CVE-2007-0956

Unauthorized access via krb5-telnet daemon

The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882.

CVSS 2.0 · 10.0 Critical EPSS 30.2% KEV · Not listed
Vendors
Canonical Debian Mit and 1 more
Products
Ubuntu Linux Debian Linux Kerberos 5 and 1 more
CVE-2007-0957

krb5_klog_syslog() stack buffer overflow

Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers.

CVSS 2.0 · 9.0 Critical EPSS 10.4% KEV · Not listed
Vendors
Canonical Debian Mit and 1 more
Products
Ubuntu Linux Debian Linux Kerberos 5 and 1 more
CVE-2007-0958

core-dumping unreadable binaries via PT_INTERP

Linux kernel 2.6.x before 2.6.20 allows local users to read unreadable binaries by using the interpreter (PT_INTERP) functionality and triggering a core dump, a variant of CVE-2004-1073.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2007-0988

security flaw

The zend_hash_init function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attackers to cause a denial of service (infinite loop) by unserializing certain integer expressions, which only cause 32-bit arguments to be used after the check for a negative value, as demonstrated by an "a:2147483649:{" argument.

CVSS 2.0 · 4.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Php Redhat
Products
Ubuntu Linux Php Enterprise Linux and 2 more
CVE-2007-0994

security flaw

A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or (3) style tag, which bypasses the access checks and executes code with chrome privileges.

CVSS 2.0 · 6.8 Medium EPSS 3.3% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Seamonkey and 1 more