Export limit exceeded: 10491 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,064

Export CSV
CVE-2016-8743

httpd: Apache HTTP Request Parsing Whitespace Defects

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.

CVSS 3.1 · 7.5 High EPSS 13.3% KEV · Not listed
Vendors
Apache Debian Netapp and 1 more
Products
Http Server Debian Linux Clustered Data Ontap and 10 more
CVE-2017-3641

mysql: Server: DML unspecified vulnerability (CPU Jul 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 3.2% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 9 more
CVE-2017-3653

mysql: Server: DDL unspecified vulnerability (CPU Jul 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.56 and earlier, 5.6.36 and earlier and 5.7.18 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.1 · 3.1 Low EPSS 1.9% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 9 more
CVE-2016-8610

SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

CVSS 3.1 · 7.5 High EPSS 39.9% KEV · Not listed
Vendors
Debian Fujitsu Netapp and 4 more
Products
Debian Linux M10-1 M10-1 Firmware and 52 more
CVE-2016-7426

ntp: Client rate limiting and server responses

NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.

CVSS 3.1 · 7.5 High EPSS 12.4% KEV · Not listed
Vendors
Canonical Hpe Ntp and 1 more
Products
Ubuntu Linux Hpux-ntp Ntp and 7 more
CVE-2017-3636

mysql: Client programs unspecified vulnerability (CPU Jul 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are affected are 5.5.56 and earlier and 5.6.36 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.0 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 9 more
CVE-2017-3308

mysql: Server: DML unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).

CVSS 3.1 · 7.7 High EPSS 3.1% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 8 more
CVE-2017-3309

mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. While the vulnerability is in MySQL Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 7.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).

CVSS 3.1 · 7.7 High EPSS 3.1% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 8 more
CVE-2016-5011

util-linux: Extended partition loop in MBR partition table leads to DOS

The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm Kernel Redhat
Products
Power Hardware Management Console Powerkvm Util-linux and 7 more
CVE-2017-3453

mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 8 more
CVE-2017-9776

poppler: Integer overflow in JBIG2Stream.cc

Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.

CVSS 3.0 · 7.8 High EPSS 2.0% KEV · Not listed
Vendors
Debian Freedesktop Redhat
Products
Debian Linux Poppler Enterprise Linux and 6 more
CVE-2017-9788

httpd: Uninitialized memory reflection in mod_auth_digest

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.

CVSS 3.0 · 9.1 Critical EPSS 56.8% KEV · Not listed
Vendors
Apache Apple Debian and 3 more
Products
Http Server Mac Os X Debian Linux and 15 more
CVE-2016-2518

ntp: out-of-bounds references on crafted packet

The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.

CVSS 3.1 · 5.3 Medium EPSS 15.1% KEV · Not listed
Vendors
Debian Freebsd Netapp and 4 more
Products
Debian Linux Freebsd Clustered Data Ontap and 17 more
CVE-2017-9462

mercurial: Python debugger accessible to authorized users

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

CVSS 3.1 · 8.8 High EPSS 21.7% KEV · Not listed
Vendors
Debian Mercurial Redhat
Products
Debian Linux Mercurial Enterprise Linux and 6 more
CVE-2017-5208

icoutils: Check_offset overflow on 64-bit systems

Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted executable, which triggers a denial of service (application crash) or the possibility of execution of arbitrary code.

CVSS 3.0 · 8.8 High EPSS 3.6% KEV · Not listed
Vendors
Debian Icoutils Project Redhat
Products
Debian Linux Icoutils Enterprise Linux and 6 more
CVE-2017-3313

mysql: Server: MyISAM unspecified vulnerability (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS v3.0 Base Score 4.7 (Confidentiality impacts).

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2017-9775

poppler: Stack-buffer overflow in GfxState.cc

Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document.

CVSS 3.0 · 6.5 Medium EPSS 4.3% KEV · Not listed
Vendors
Debian Freedesktop Redhat
Products
Debian Linux Poppler Enterprise Linux and 6 more
CVE-2017-3456

mysql: Server: DML unspecified vulnerability (CPU Apr 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Easily "exploitable" vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 3.0% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 8 more
CVE-2017-7980

Qemu: display: cirrus: OOB r/w access issues in bitblt routines

Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 9 more