Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 626

Export CSV
CVE-2014-4341

krb5: denial of service flaws when handling padding length longer than the plaintext

MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session.

CVSS 2.0 · 5.0 Medium EPSS 7.1% KEV · Not listed
Vendors
Debian Fedoraproject Mit and 1 more
Products
Debian Linux Fedora Kerberos 5 and 8 more
CVE-2014-3580

subversion: NULL pointer dereference flaw in mod_dav_svn when handling REPORT requests

The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVSS 2.0 · 5.0 Medium EPSS 11.0% KEV · Not listed
Vendors
Apache Apple Debian and 1 more
Products
Subversion Xcode Debian Linux and 6 more
CVE-2014-3528

subversion: credentials leak via MD5 collision

Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.

CVSS 2.0 · 4.0 Medium EPSS 7.4% KEV · Not listed
Vendors
Apache Apple Canonical and 2 more
Products
Subversion Xcode Ubuntu Linux and 7 more
CVE-2010-5325

foomatic: potential remote arbitrary code execution

Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via a long job title.

CVSS 3.0 · 9.8 Critical EPSS 5.5% KEV · Not listed
Vendors
Linuxfoundation Oracle Redhat
Products
Foomatic-filters Linux Enterprise Linux and 5 more
CVE-2013-3331

flash-plugin: multiple code execution flaws (APSB13-14)

Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2728, CVE-2013-3324, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335.

CVSS 2.0 · 10.0 Critical EPSS 5.3% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Adobe Air Adobe Air Sdk Flash Player and 12 more
CVE-2011-0711

kernel: xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1

The xfs_fs_geometry function in fs/xfs/xfs_fsops.c in the Linux kernel before 2.6.38-rc6-git3 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FSGEOMETRY_V1 ioctl call.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2011-1776

kernel: validate size of EFI GUID partition entries

The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allows physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2011-2834

libxml2: double-free caused by malformed XPath expression in XSLT

Double free vulnerability in libxml2, as used in Google Chrome before 14.0.835.163, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.

CVSS 2.0 · 6.8 Medium EPSS 2.0% KEV · Not listed
Vendors
Apple Debian Google and 1 more
Products
Iphone Os Mac Os X Debian Linux and 6 more
CVE-2011-3919

libxml2: Heap-based buffer overflow when decoding an entity reference with a long name

Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Apple Debian Google and 2 more
Products
Iphone Os Mac Os X Debian Linux and 8 more
CVE-2010-4008

libxml2: Crash (stack frame overflow or NULL pointer dereference) by traversal of XPath axis

libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.

CVSS 2.0 · 4.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Apache Apple Canonical and 6 more
Products
Openoffice Iphone Os Itunes and 13 more
CVE-2012-5689

bind: denial of service when processing queries and with both DNS64 and RPZ enabled

ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record.

CVSS 2.0 · 7.1 High EPSS 12.1% KEV · Not listed
Vendors
Canonical Isc Redhat
Products
Ubuntu Linux Bind Enterprise Linux and 6 more
CVE-2012-5830

Mozilla: Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer (MFSA 2012-106)

Use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 on Mac OS X allows remote attackers to execute arbitrary code via an HTML document.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Apple Canonical Mozilla and 3 more
Products
Mac Os X Ubuntu Linux Firefox and 13 more
CVE-2012-6137

subscription-manager: rhn-migrate-classic-to-rhsm missing SSL certificate verification

rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Eus and 6 more
CVE-2013-1555

mysql: unspecified DoS related to Server Partition (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, and 5.5.29 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Partition.

CVSS 2.0 · 4.0 Medium EPSS 2.6% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 5 more
CVE-2013-2728

flash-plugin: multiple code execution flaws (APSB13-14)

Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-3324, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335.

CVSS 2.0 · 10.0 Critical EPSS 5.3% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Adobe Air Adobe Air Sdk Flash Player and 12 more
CVE-2013-3324

flash-plugin: multiple code execution flaws (APSB13-14)

Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2728, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335.

CVSS 2.0 · 10.0 Critical EPSS 5.4% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Adobe Air Adobe Air Sdk Flash Player and 12 more
CVE-2013-3325

flash-plugin: multiple code execution flaws (APSB13-14)

Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2728, CVE-2013-3324, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335.

CVSS 2.0 · 10.0 Critical EPSS 5.4% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Adobe Air Adobe Air Sdk Flash Player and 12 more
CVE-2013-3326

flash-plugin: multiple code execution flaws (APSB13-14)

Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2728, CVE-2013-3324, CVE-2013-3325, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335.

CVSS 2.0 · 10.0 Critical EPSS 5.4% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Adobe Air Adobe Air Sdk Flash Player and 12 more
CVE-2013-3327

flash-plugin: multiple code execution flaws (APSB13-14)

Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2728, CVE-2013-3324, CVE-2013-3325, CVE-2013-3326, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335.

CVSS 2.0 · 10.0 Critical EPSS 5.4% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Adobe Air Adobe Air Sdk Flash Player and 12 more