Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6,068

Export CSV
CVE-2014-0584

flash-plugin: multiple code execution flaws (APSB14-24)

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0585, CVE-2014-0586, and CVE-2014-0590.

CVSS 2.0 · 10.0 Critical EPSS 5.5% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2014-0585

flash-plugin: multiple code execution flaws (APSB14-24)

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0586, and CVE-2014-0590.

CVSS 2.0 · 10.0 Critical EPSS 4.5% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2014-0586

flash-plugin: multiple code execution flaws (APSB14-24)

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, and CVE-2014-0590.

CVSS 2.0 · 10.0 Critical EPSS 5.5% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2014-0587

flash-plugin: Multiple code-execution flaws (APSB14-27)

Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9164.

CVSS 2.0 · 10.0 Critical EPSS 4.5% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Flash Player Mac Os X Linux Kernel and 2 more
CVE-2014-0588

flash-plugin: multiple code execution flaws (APSB14-24)

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0573 and CVE-2014-8438.

CVSS 2.0 · 10.0 Critical EPSS 6.0% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2014-0589

flash-plugin: multiple code execution flaws (APSB14-24)

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0582.

CVSS 2.0 · 10.0 Critical EPSS 8.7% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2014-0590

flash-plugin: multiple code execution flaws (APSB14-24)

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, and CVE-2014-0586.

CVSS 2.0 · 10.0 Critical EPSS 5.5% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2014-1690

Kernel: netfilter: nf_nat: leakage of uninitialized buffer in IRC NAT helper

The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.

CVSS 2.0 · 2.6 Low EPSS 3.9% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Mrg
CVE-2014-1737

kernel: block: floppy: privilege escalation via FDRAWCMD floppy ioctl command

The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Oracle and 2 more
Products
Debian Linux Linux Kernel Linux and 9 more
CVE-2014-1738

kernel: block: floppy: privilege escalation via FDRAWCMD floppy ioctl command

The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Debian Linux Oracle and 2 more
Products
Debian Linux Linux Kernel Linux and 9 more
CVE-2014-1739

Kernel: drivers: media: an information leakage

The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.

CVSS 2.0 · 2.1 Low EPSS 1.1% KEV · Not listed
Vendors
Canonical Linux Redhat and 1 more
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 3 more
CVE-2014-1874

Kernel: SELinux: local denial-of-service

The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat and 1 more
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 2 more
CVE-2014-2038

kernel: nfs: data leak during extended writes

The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux
CVE-2014-2039

Kernel: s390: crash due to linkage stack instructions

arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2014-2309

Kernel: net: IPv6: crash due to router advertisement flooding

The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets.

CVSS 2.0 · 6.1 Medium EPSS 2.4% KEV · Not listed
Vendors
Linux Opensuse Redhat and 1 more
Products
Linux Kernel Opensuse Enterprise Mrg and 1 more
CVE-2014-2494

mysql: unspecified vulnerability related to ENARC (CPU July 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to ENARC.

CVSS 2.0 · 4.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Debian Mariadb Oracle and 2 more
Products
Debian Linux Mariadb Mysql and 7 more
CVE-2014-2497

gd: NULL pointer dereference in gdImageCreateFromXpm()

The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.

CVSS 2.0 · 4.3 Medium EPSS 20.3% KEV · Not listed
Vendors
Canonical Debian Oracle and 3 more
Products
Ubuntu Linux Debian Linux Solaris and 11 more
CVE-2014-2523

kernel: netfilter: nf_conntrack_dccp: incorrect skb_header_pointer API usages

net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function.

CVSS 2.0 · 10.0 Critical EPSS 10.4% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 3 more
CVE-2014-2568

kernel: net: potential information leak when ubuf backed skbs are skb_zerocopy()ied

Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced.

CVSS 2.0 · 2.9 Low EPSS 1.0% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux
CVE-2014-2672

kernel: ath9k: tid->sched race in ath_tx_aggr_sleep()

Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions.

CVSS 2.0 · 7.1 High EPSS 2.7% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more