Export limit exceeded: 425857 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425857 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,046

Export CSV
CVE-2015-5119

flash-plugin: code execution issue in APSA15-03 / APSB15-16

Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

CVSS 3.1 · 7.8 High EPSS 98.6% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Mac Os X Linux Kernel and 12 more
CVE-2015-5122

flash-plugin: two code execution issues in APSA15-04 / APSB15-18

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

CVSS 3.1 · 7.8 High EPSS 87.0% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Flash Player Desktop Runtime Macos and 12 more
CVE-2015-5123

flash-plugin: two code execution issues in APSA15-04 / APSB15-18

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

CVSS 3.1 · 7.8 High EPSS 18.8% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Flash Player Desktop Runtime Macos and 10 more
CVE-2016-1019

flash-plugin: multiple code execution issues fixed in APSB16-10

Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

CVSS 3.1 · 7.8 High EPSS 22.3% KEV · Listed
Vendors
Adobe Apple Google and 3 more
Products
Air Desktop Runtime Air Sdk Air Sdk \& Compiler and 11 more
CVE-2016-4117

flash-plugin: multiple code execution issues fixed in APSB16-15

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

CVSS 3.1 · 7.8 High EPSS 94.3% KEV · Listed
Vendors
Adobe Opensuse Redhat and 1 more
Products
Flash Player Evergreen Opensuse and 7 more
CVE-2016-4171

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

CVSS 3.1 · 7.8 High EPSS 20.2% KEV · Listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Mac Os X Macos and 12 more
CVE-2013-0640

acroread: Multiple unspecified vulnerabilities allow remote attackers to execute arbitrary code (APSB13-07)

Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.

CVSS 3.1 · 7.8 High EPSS 86.9% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Acrobat Acrobat Reader Mac Os X and 10 more
CVE-2013-0641

acroread: Multiple unspecified vulnerabilities allow remote attackers to execute arbitrary code (APSB13-07)

Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.

CVSS 3.1 · 7.8 High EPSS 32.3% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Acrobat Acrobat Reader Mac Os X and 10 more
CVE-2013-0643

flash-plugin: Firefox sandbox permissions issue (APSB13-08)

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

CVSS 3.1 · 8.8 High EPSS 10.5% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Mac Os X Linux Kernel and 9 more
CVE-2013-0648

flash-plugin: multiple code execution flaws (APSB13-08)

Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

CVSS 3.1 · 8.8 High EPSS 11.1% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Mac Os X Linux Kernel and 9 more
CVE-2010-2883

Acroread: Stack-based buffer overflow by processing certain fonts (APSA10-02)

Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.

CVSS 3.1 · 7.3 High EPSS 81.4% KEV · Listed
Vendors
Adobe Apple Microsoft and 1 more
Products
Acrobat Acrobat Reader Macos and 2 more
CVE-2011-0609

flash-plugin: crash and potential arbitrary code execution (APSB11-05)

Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.

CVSS 3.1 · 7.8 High EPSS 63.5% KEV · Listed
Vendors
Adobe Apple Google and 6 more
Products
Acrobat Acrobat Reader Air and 12 more
CVE-2011-0611

flash-plugin: crash and potential arbitrary code execution (APSB11-07)

Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.

CVSS 3.1 · 8.8 High EPSS 99.4% KEV · Listed
Vendors
Adobe Apple Google and 6 more
Products
Acrobat Acrobat Reader Adobe Air and 13 more
CVE-2012-1723

OpenJDK: insufficient field accessibility checks (HotSpot, 7152811)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS 3.1 · 9.8 Critical EPSS 93.6% KEV · Listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 7 more
CVE-2012-2034

flash-plugin: multiple code execution flaws (APSB12-14)

Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037.

CVSS 3.1 · 7.5 High EPSS 7.7% KEV · Listed
Vendors
Adobe Apple Google and 5 more
Products
Air Flash Player Macos and 11 more
CVE-2013-0422

OpenJDK: MethodHandles.Lookup incorrect permission checks, Java 7 0day (Libraries, 8006017)

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.

CVSS 3.1 · 9.8 Critical EPSS 97.1% KEV · Listed
Vendors
Canonical Opensuse Oracle and 1 more
Products
Ubuntu Linux Opensuse Jdk and 3 more
CVE-2012-5076

OpenJDK: com.sun.org.glassfish.* not restricted packages (JAX-WS, 7163198)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.

CVSS 3.1 · 9.8 Critical EPSS 91.2% KEV · Listed
Vendors
Oracle Redhat Suse
Products
Jre Enterprise Linux Rhel Extras and 1 more
CVE-2007-5659

acroread Multiple buffer overflows

Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to unspecified JavaScript methods. NOTE: this issue might be subsumed by CVE-2008-0655.

CVSS 3.1 · 7.8 High EPSS 87.3% KEV · Listed
Vendors
Adobe Redhat
Products
Acrobat Acrobat Reader Rhel Extras
CVE-2012-4681

OpenJDK: beans insufficient permission checks, Java 7 0day (beans, 7162473)

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

CVSS 3.1 · 9.8 Critical EPSS 98.5% KEV · Listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 5 more