Export limit exceeded: 425857 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,046

Export CSV
CVE-2008-4823

Flash Player HTML injection flaw

Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to loose interpretation of an ActionScript attribute.

CVSS 2.0 · 4.3 Medium EPSS 5.9% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Rhel Extras
CVE-2009-3799

flash-plugin: multiple code execution flaws (APSB09-19) (CVE-2009-3794, CVE-2009-3796, CVE-2009-3797, CVE-2009-3798, CVE-2009-3799, CVE-2009-3800)

Integer overflow in the Verifier::parseExceptionHandlers function in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allows remote attackers to execute arbitrary code via an SWF file with a large exception_count value that triggers memory corruption, related to "generation of ActionScript exception handlers."

CVSS 2.0 · 9.3 Critical EPSS 10.0% KEV · Not listed
Vendors
Adobe Redhat
Products
Adobe Air Flash Player Rhel Extras
CVE-2009-3798

flash-plugin: multiple code execution flaws (APSB09-19) (CVE-2009-3794, CVE-2009-3796, CVE-2009-3797, CVE-2009-3798, CVE-2009-3799, CVE-2009-3800)

Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 might allow attackers to execute arbitrary code via unspecified vectors that trigger memory corruption.

CVSS 2.0 · 9.3 Critical EPSS 6.3% KEV · Not listed
Vendors
Adobe Redhat
Products
Adobe Air Flash Player Rhel Extras
CVE-2008-4822

Flash Player policy file interpretation flaw

Adobe Flash Player 9.0.124.0 and earlier does not properly interpret policy files, which allows remote attackers to bypass a non-root domain policy.

CVSS 2.0 · 6.8 Medium EPSS 6.6% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Rhel Extras
CVE-2007-5273

Anti-DNS Pinning and Java Applets with HTTP proxy

Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2_15 and earlier, and SDK and JRE 1.3.1_20 and earlier, when an HTTP proxy server is used, allows remote attackers to violate the security model for an applet's outbound connections via a multi-pin DNS rebinding attack in which the applet download relies on DNS resolution on the proxy server, but the applet's socket operations rely on DNS resolution on the local machine, a different issue than CVE-2007-5274. NOTE: this is similar to CVE-2007-5232.

CVSS 2.0 · 2.6 Low EPSS 2.7% KEV · Not listed
Vendors
Redhat Sun
Products
Rhel Extras Jdk Jre and 1 more
CVE-2009-1862

flash-plugin: Remote code execution vulnerability via malicious SWF (Shockwave Flash) content

Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.

CVSS 3.1 · 7.8 High EPSS 21.2% KEV · Listed
Vendors
Adobe Redhat
Products
Acrobat Acrobat Reader Flash Player and 1 more
CVE-2009-0927

security flaw

Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different vulnerability than CVE-2009-0658.

CVSS 3.1 · 8.8 High EPSS 96.6% KEV · Listed
Vendors
Adobe Redhat
Products
Acrobat Reader Rhel Extras
CVE-2008-2992

Reader: JavaScript util.printf() function buffer overflow

Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.

CVSS 3.1 · 7.8 High EPSS 99.8% KEV · Listed
Vendors
Adobe Oracle Redhat
Products
Acrobat Acrobat Reader Solaris and 1 more
CVE-2016-3427

OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

CVSS 3.1 · 9.8 Critical EPSS 92.3% KEV · Listed
Vendors
Apache Canonical Debian and 5 more
Products
Cassandra Ubuntu Linux Debian Linux and 39 more
CVE-2012-0507

OpenJDK: AtomicReferenceArray insufficient array type check (Concurrency, 7082299)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.

CVSS 3.1 · 9.8 Critical EPSS 98.2% KEV · Listed
Vendors
Debian Oracle Redhat and 2 more
Products
Debian Linux Jre Enterprise Linux and 7 more
CVE-2011-3544

OpenJDK: missing SecurityManager checks in scripting engine (Scripting, 7046823)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

CVSS 3.1 · 9.8 Critical EPSS 96.7% KEV · Listed
Vendors
Canonical Oracle Redhat and 1 more
Products
Ubuntu Linux Jdk Jre and 6 more
CVE-2013-2465

OpenJDK: Incorrect image channel verification (2D, 8012597)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.

CVSS 3.1 · 9.8 Critical EPSS 98.8% KEV · Listed
Vendors
Oracle Redhat Sun and 1 more
Products
Jre Enterprise Linux Network Satellite and 7 more
CVE-2013-2423

OpenJDK: incorrect setter access checks in MethodHandles (Hostspot, 8009677)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.

CVSS 3.1 · 3.7 Low EPSS 85.2% KEV · Listed
Vendors
Canonical Opensuse Oracle and 1 more
Products
Ubuntu Linux Opensuse Jre and 2 more
CVE-2015-4902

JDK: unspecified vulnerability fixed in 6u105, 7u91 and 8u65 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

CVSS 3.1 · 5.3 Medium EPSS 13.6% KEV · Listed
Vendors
Opensuse Oracle Redhat and 1 more
Products
Leap Opensuse Jdk and 21 more
CVE-2016-0984

flash-plugin: multiple code execution issues fixed in APSB16-04

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.

CVSS 3.1 · 8.8 High EPSS 54.5% KEV · Listed
Vendors
Adobe Apple Google and 3 more
Products
Air Desktop Runtime Air Sdk Air Sdk \& Compiler and 9 more
CVE-2015-8651

flash-plugin: multiple code execution issues fixed in APSB16-01

Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.

CVSS 3.1 · 8.8 High EPSS 67.7% KEV · Listed
Vendors
Adobe Apple Google and 6 more
Products
Air Air Sdk Air Sdk \& Compiler and 20 more
CVE-2015-7645

flash-plugin: multiple code execution issue fixed in APSB15-27

Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

CVSS 3.1 · 7.8 High EPSS 65.3% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Mac Os X Linux Kernel and 11 more
CVE-2016-1010

flash-plugin: multiple code execution issues fixed in APSB16-08

Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.

CVSS 3.1 · 8.8 High EPSS 19.3% KEV · Listed
Vendors
Adobe Apple Google and 4 more
Products
Air Air Desktop Runtime Air Sdk and 13 more
CVE-2017-11292

flash-plugin: remote code execution vulnerability (APSB17-32)

Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 11.2% KEV · Listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 9 more
CVE-2013-2729

acroread: multiple code execution flaws (APSB13-15)

Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.

CVSS 3.1 · 8.8 High EPSS 66.6% KEV · Listed
Vendors
Adobe Redhat Suse
Products
Acrobat Acrobat Reader Enterprise Linux Desktop and 6 more