Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 160

Export CSV
CVE-2016-5410

firewalld: Firewall configuration can be modified by any logged in user

firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Firewalld Redhat
Products
Firewalld Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2016-5416

389-ds-base: ACI readable by anonymous user

389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node and 2 more
CVE-2015-5300

ntp: MITM attacker can force ntpd to make a step larger than the panic threshold

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).

CVSS 3.0 · 7.5 High EPSS 9.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2016-9635

gstreamer-plugins-good: Heap buffer overflow in FLIC decoder

Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'skip count' that goes beyond initialized buffer.

CVSS 3.0 · 9.8 Critical EPSS 8.8% KEV · Not listed
Vendors
Debian Gstreamer Redhat
Products
Debian Linux Gstreamer Enterprise Linux and 4 more
CVE-2016-4455

subscription-manager: sensitive world readable files in /var/lib/rhsm/

The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node and 3 more
CVE-2016-4444

setroubleshoot-plugins: insecure commands.getstatusoutput use in the allow_execmod plugin

The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename, related to the commands.getstatusoutput function.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat Setroubleshoot Project
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node and 3 more
CVE-2014-9661

freetype: out of bounds read in Type42 font parser

type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font.

CVSS 2.0 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2014-9660

freetype: missing ENDCHAR NULL pointer dereference in the _bdf_parse_glyphs()

The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2014-3640

qemu: slirp: NULL pointer deref in sosendto()

The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 5 more
CVE-2014-9658

freetype: buffer over-read and integer underflow in tt_face_load_kern()

The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2014-9657

freetype: off-by-one buffer over-read in tt_face_load_hdmx()

The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2014-3580

subversion: NULL pointer dereference flaw in mod_dav_svn when handling REPORT requests

The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVSS 2.0 · 5.0 Medium EPSS 11.0% KEV · Not listed
Vendors
Apache Apple Debian and 1 more
Products
Subversion Xcode Debian Linux and 6 more
CVE-2015-2348

php: move_uploaded_file() NUL byte injection in file name

The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 5.0 Medium EPSS 8.3% KEV · Not listed
Vendors
Apple Opensuse Php and 1 more
Products
Mac Os X Opensuse Php and 8 more
CVE-2014-9273

hivex: missing checks for small-sized files

lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Redhat
Products
Hivex Opensuse Enterprise Linux and 4 more
CVE-2014-8564

gnutls: Heap corruption when generating key ID for ECC (GNUTLS-SA-2014-5)

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

CVSS 2.0 · 5.0 Medium EPSS 3.3% KEV · Not listed
Vendors
Canonical Gnu Opensuse and 1 more
Products
Ubuntu Linux Gnutls Opensuse and 5 more
CVE-2014-3528

subversion: credentials leak via MD5 collision

Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.

CVSS 2.0 · 4.0 Medium EPSS 7.4% KEV · Not listed
Vendors
Apache Apple Canonical and 2 more
Products
Subversion Xcode Ubuntu Linux and 7 more
CVE-2014-8169

autofs: priv escalation via interpreter load path for program based automount maps

automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Automount Project Opensuse Redhat
Products
Automount Opensuse Enterprise Linux and 4 more
CVE-2012-6662

jquery-ui: XSS vulnerability in default content in Tooltip widget

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

CVSS 2.0 · 4.3 Medium EPSS 7.5% KEV · Not listed
Vendors
Jqueryui Redhat
Products
Jquery Ui Enterprise Linux Enterprise Linux Desktop and 3 more