Export limit exceeded: 425829 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,935

Export CSV
CVE-2017-5104

chromium-browser: ui spoofing in browser

Inappropriate implementation in interstitials in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to spoof the contents of the omnibox via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Apple Debian Google and 1 more
Products
Macos Debian Linux Chrome and 4 more
CVE-2017-5108

chromium-browser: type confusion in pdfium

Type confusion in PDFium in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Apple Google Linux and 2 more
Products
Macos Android Chrome and 6 more
CVE-2015-7852

ntp: ntpq atoascii memory corruption vulnerability

ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.

CVSS 3.1 · 5.9 Medium EPSS 12.3% KEV · Not listed
Vendors
Debian Netapp Ntp and 2 more
Products
Debian Linux Clustered Data Ontap Data Ontap and 12 more
CVE-2015-7837

kernel: securelevel disabled after kexec

The Linux kernel, as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended securelevel/secureboot restrictions by leveraging improper handling of secure_boot flag across kexec reboot.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Server Aus and 4 more
CVE-2017-5102

chromium-browser: uninitialized use in skia

Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Apple Debian Google and 3 more
Products
Macos Debian Linux Android and 7 more
CVE-2017-5109

chromium-browser: ui spoofing in browser

Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Apple Debian Google and 3 more
Products
Macos Debian Linux Chrome and 6 more
CVE-2015-7692

ntp: incomplete checks in ntp_crypto.c

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

CVSS 3.1 · 7.5 High EPSS 6.5% KEV · Not listed
Vendors
Debian Netapp Ntp and 2 more
Products
Debian Linux Clustered Data Ontap Data Ontap and 11 more
CVE-2015-7691

ntp: incomplete checks in ntp_crypto.c

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

CVSS 3.1 · 7.5 High EPSS 7.1% KEV · Not listed
Vendors
Debian Netapp Ntp and 2 more
Products
Debian Linux Clustered Data Ontap Data Ontap and 11 more
CVE-2015-7701

ntp: slow memory leak in CRYPTO_ASSOC

Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).

CVSS 3.1 · 7.5 High EPSS 6.5% KEV · Not listed
Vendors
Debian Netapp Ntp and 2 more
Products
Debian Linux Clustered Data Ontap Data Ontap and 11 more
CVE-2015-7702

ntp: incomplete checks in ntp_crypto.c

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

CVSS 3.1 · 6.5 Medium EPSS 5.2% KEV · Not listed
Vendors
Debian Netapp Ntp and 2 more
Products
Debian Linux Clustered Data Ontap Data Ontap and 11 more
CVE-2017-5100

chromium-browser: use after free in chrome apps

A use after free in Apps in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Debian Google Microsoft and 1 more
Products
Debian Linux Chrome Windows and 4 more
CVE-2015-7529

sos: Usage of predictable temporary files allows privilege escalation

sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Redhat Sos Project
Products
Ubuntu Linux Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-7703

ntp: config command can be used to set the pidfile and drift file paths

The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Debian Netapp Ntp and 2 more
Products
Debian Linux Clustered Data Ontap Data Ontap and 11 more
CVE-2017-5098

chromium-browser: use after free in v8

A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 15.5% KEV · Not listed
Vendors
Apple Debian Google and 3 more
Products
Macos Debian Linux Android and 7 more
CVE-2017-5101

chromium-browser: url spoofing in omnibox

Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Apple Debian Google and 3 more
Products
Macos Debian Linux Chrome and 6 more
CVE-2017-5110

chromium-browser: ui spoofing in payments dialog

Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Apple Debian Google and 3 more
Products
Macos Debian Linux Android and 7 more
CVE-2015-5300

ntp: MITM attacker can force ntpd to make a step larger than the panic threshold

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).

CVSS 3.0 · 7.5 High EPSS 9.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2017-5088

chromium-browser: out of bounds read in v8

Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 3.2% KEV · Not listed
Vendors
Apple Google Linux and 2 more
Products
Macos Android Chrome and 6 more
CVE-2017-5086

chromium-browser: address spoofing in omnibox

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 59.0.3071.86 for Windows and Mac allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Apple Google Microsoft and 1 more
Products
Macos Chrome Windows and 4 more