Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2013-7456

gd: incorrect boundary adjustment in _gdContributionsCalc

gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function.

CVSS 3.0 · 7.6 High EPSS 3.8% KEV · Not listed
Vendors
Libgd Php Redhat
Products
Libgd Php Rhel Software Collections
CVE-2015-5289

postgresql: stack overflow DoS when parsing json or jsonb inputs

Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values.

CVSS 2.0 · 6.4 Medium EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 2 more
CVE-2015-5288

postgresql: limited memory disclosure flaw in crypt()

The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt.

CVSS 2.0 · 6.4 Medium EPSS 4.5% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Enterprise Linux Rhel Software Collections
CVE-2014-8120

thermostat: local JMX URL disclosure

The agent in Thermostat before 1.0.6, when using unspecified configurations, allows local users to obtain the JMX management URLs of all local Java virtual machines and gain privileges via unknown vectors.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Thermostat Project
Products
Rhel Software Collections Thermostat
CVE-2015-5073

pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18)

Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.

CVSS 3.0 · 9.1 Critical EPSS 7.7% KEV · Not listed
Vendors
Ibm Pcre Redhat
Products
Powerkvm Pcre Enterprise Linux and 1 more
CVE-2015-4913

mysql: unspecified vulnerability related to Server:DML (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858.

CVSS 2.0 · 3.5 Low EPSS 3.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 14 more
CVE-2014-8090

ruby: REXML incomplete fix for CVE-2014-8080

The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080.

CVSS 2.0 · 5.0 Medium EPSS 5.7% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Rhel Software Collections Ruby
CVE-2013-7440

python: wildcard matching rules do not follow RFC 6125

The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.

CVSS 3.0 · 5.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Python Redhat
Products
Python Rhel Software Collections Satellite and 1 more
CVE-2015-4910

mysql: unspecified vulnerability related to Server:Memcached (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.

CVSS 2.0 · 2.1 Low EPSS 2.0% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Enterprise Linux Rhel Software Collections
CVE-2015-4904

mysql: unspecified vulnerability related to libmysqld (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to libmysqld.

CVSS 2.0 · 4.0 Medium EPSS 2.6% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Rhel Software Collections
CVE-2014-8080

ruby: REXML billion laughs attack via parameter entity expansion

The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.

CVSS 2.0 · 5.0 Medium EPSS 5.6% KEV · Not listed
Vendors
Canonical Opensuse Redhat and 1 more
Products
Ubuntu Linux Opensuse Enterprise Linux and 2 more
CVE-2015-4895

mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.

CVSS 2.0 · 3.5 Low EPSS 2.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2015-4890

mysql: unspecified vulnerability related to Server:Replication (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Replication.

CVSS 2.0 · 3.5 Low EPSS 1.9% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Enterprise Linux Rhel Software Collections
CVE-2014-7191

nodejs-qs: Denial-of-Service Memory Exhaustion

The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.

CVSS 2.0 · 5.0 Medium EPSS 8.3% KEV · Not listed
Vendors
Nodejs Redhat
Products
Node.js Rhel Software Collections
CVE-2014-1912

python: buffer overflow in socket.recvfrom_into()

Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.

CVSS 2.0 · 7.5 High EPSS 27.2% KEV · Not listed
Vendors
Apple Python Redhat
Products
Mac Os X Python Enterprise Linux and 1 more
CVE-2013-5704

httpd: bypass of mod_headers rules via chunked requests

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

CVSS 2.0 · 5.0 Medium EPSS 58.0% KEV · Not listed
Vendors
Apache Apple Canonical and 2 more
Products
Http Server Mac Os X Mac Os X Server and 14 more
CVE-2015-4879

mysql: unspecified vulnerability related to Server:DML (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to DML.

CVSS 2.0 · 4.6 Medium EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2015-4870

mysql: unspecified vulnerability related to Server:Parser (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser.

CVSS 2.0 · 4.0 Medium EPSS 30.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 14 more
CVE-2014-7185

python: buffer() integer overflow leading to out of bounds read

Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.

CVSS 2.0 · 6.4 Medium EPSS 5.1% KEV · Not listed
Vendors
Apple Python Redhat
Products
Mac Os X Python Enterprise Linux and 1 more
CVE-2015-4866

mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.

CVSS 2.0 · 4.0 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Mariadb Oracle and 1 more
Products
Ubuntu Linux Mariadb Mysql and 1 more