Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 42

Export CSV
CVE-2013-5613

Mozilla: Use-after-free in synthetic mouse movement (MFSA 2013-114)

Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving synthetic mouse movement, related to the RestyleManager::GetHoverGeneration function.

CVSS 3.1 · 9.8 Critical EPSS 9.4% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 3 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2013-5615

Mozilla: GetElementIC typed array stubs can be generated outside observed typesets (MFSA 2013-115)

The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not properly enforce certain typeset restrictions on the generation of GetElementIC typed array stubs, which has unspecified impact and remote attack vectors.

CVSS 3.1 · 9.8 Critical EPSS 4.2% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 2 more
Products
Ubuntu Linux Fedora Firefox and 6 more
CVE-2013-5616

Mozilla: Use-after-free in event listeners (MFSA 2013-108)

Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to mListeners event listeners.

CVSS 3.1 · 9.8 Critical EPSS 6.7% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 3 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2013-5618

Mozilla: Use-after-free during Table Editing (MFSA 2013-109)

Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code by triggering improper garbage collection.

CVSS 3.1 · 9.8 Critical EPSS 10.4% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 3 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2013-6671

Mozilla: Segmentation violation when replacing ordered list elements (MFSA 2013-111)

The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code via crafted use of JavaScript code for ordered list elements.

CVSS 3.1 · 9.8 Critical EPSS 11.1% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 3 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2014-9853

ImageMagick: memory leak in rle file handling

Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file.

CVSS 3.1 · 5.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Imagemagick Novell and 3 more
Products
Ubuntu Linux Imagemagick Leap and 8 more
CVE-2015-3340

xen: information leak through XEN_DOMCTL_gettscinfo (xsa132)

Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

CVSS 2.0 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Opensuse and 2 more
Products
Debian Linux Fedora Opensuse and 6 more
CVE-2015-8816

kernel: USB hub invalid memory access in hub_activate()

The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Novell Suse
Products
Linux Kernel Suse Linux Enterprise Debuginfo Suse Linux Enterprise Desktop and 8 more
CVE-2015-8845

kernel: incorrect restoration of machine specific registers from userspace

The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Novell Redhat and 1 more
Products
Linux Kernel Suse Linux Enterprise Desktop Suse Linux Enterprise Server and 7 more
CVE-2016-3951

kernel: crash on invalid USB device descriptors (usbnet driver)

Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor.

CVSS 3.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Novell and 1 more
Products
Ubuntu Linux Linux Kernel Suse Linux Enterprise Desktop and 7 more
CVE-2016-5244

kernel: Information leak in rds_inc_info_copy

The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.

CVSS 3.0 · 7.5 High EPSS 5.5% KEV · Not listed
Vendors
Fedoraproject Linux Redhat and 1 more
Products
Fedora Linux Kernel Enterprise Linux and 8 more
CVE-2013-1864

ptlib: denial of service processing certain XML documents

The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a "billion laughs attack."

CVSS 2.0 · 4.3 Medium EPSS 2.9% KEV · Not listed
Vendors
Ekiga Opalvoip Suse
Products
Ekiga Portable Tool Library Suse Linux Enterprise Desktop and 1 more
CVE-2014-4258

mysql: unspecified vulnerability related to SRINFOSC (CPU July 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRINFOSC.

CVSS 2.0 · 6.5 Medium EPSS 3.5% KEV · Not listed
Vendors
Debian Mariadb Opensuse Project and 4 more
Products
Debian Linux Mariadb Suse Linux Enterprise Desktop and 12 more
CVE-2015-0439

mysql: unspecified vulnerability related to Server:InnoDB (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-4756.

CVSS 2.0 · 4.0 Medium EPSS 2.3% KEV · Not listed
Vendors
Novell Oracle Suse
Products
Suse Linux Enterprise Desktop Suse Linux Enterprise Server Mysql and 2 more
CVE-2012-5830

Mozilla: Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer (MFSA 2012-106)

Use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 on Mac OS X allows remote attackers to execute arbitrary code via an HTML document.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Apple Canonical Mozilla and 3 more
Products
Mac Os X Ubuntu Linux Firefox and 13 more
CVE-2013-4854

bind: named crash with an assertion failure on parsing malformed rdata

The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.

CVSS 2.0 · 7.8 High EPSS 34.2% KEV · Not listed
Vendors
Fedoraproject Freebsd Hp and 7 more
Products
Fedora Freebsd Hp-ux and 9 more