Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,046

Export CSV
CVE-2010-0840

OpenJDK Applet Trusted Methods Chaining Privilege Escalation Vulnerability (6904691)

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

CVSS 3.1 · 9.8 Critical EPSS 96.3% KEV · Listed
Vendors
Canonical Opensuse Oracle and 1 more
Products
Ubuntu Linux Opensuse Jre and 4 more
CVE-2015-2590

OpenJDK: deserialization issue in ObjectInputStream.readSerialData() (Libraries, 8076401)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

CVSS 3.1 · 9.8 Critical EPSS 25.5% KEV · Listed
Vendors
Canonical Debian Opensuse and 3 more
Products
Ubuntu Linux Debian Linux Opensuse and 22 more
CVE-2016-5198

chromium-browser: out of bounds memory access in v8

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 34.2% KEV · Listed
Vendors
Apple Google Linux and 2 more
Products
Macos Android Chrome and 6 more
CVE-2017-5030

chromium-browser: memory corruption in v8

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 40.6% KEV · Listed
Vendors
Apple Debian Google and 3 more
Products
Macos Debian Linux Android and 7 more
CVE-2017-5070

chromium-browser: type confusion in v8

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 32.1% KEV · Listed
Vendors
Apple Google Linux and 2 more
Products
Macos Android Chrome and 6 more
CVE-2016-1646

chromium-browser: out-of-bounds read in V8

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.

CVSS 3.1 · 8.8 High EPSS 48.1% KEV · Listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 8 more
CVE-2016-5195

kernel: mm: privilege escalation via MAP_PRIVATE COW breakage

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

CVSS 3.1 · 7.0 High EPSS 83.5% KEV · Listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 21 more
CVE-2006-3587

security flaw

Unspecified vulnerability in Adobe (Macromedia) Flash Player 8.0.24.0 allows remote attackers to execute arbitrary commands via a malformed .swf file that results in "multiple improper memory access" errors.

CVSS 2.0 · 5.1 Medium EPSS 8.4% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Rhel Extras
CVE-2005-0710

security flaw

MySQL 4.0.23 and earlier, and 4.1.x up to 4.1.10, allows remote authenticated users with INSERT and DELETE privileges to bypass library path restrictions and execute arbitrary libraries by using INSERT INTO to modify the mysql.func table, which is processed by the udf_init function.

CVSS 2.0 · 4.6 Medium EPSS 12.4% KEV · Not listed
Vendors
Mysql Oracle Redhat
Products
Mysql Mysql Enterprise Linux and 1 more
CVE-2006-3311

security flaw

Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie.

CVSS 2.0 · 5.1 Medium EPSS 17.9% KEV · Not listed
Vendors
Adobe Redhat
Products
Flash Player Flex Sdk Rhel Extras
CVE-2004-0837

security flaw

MySQL 4.x before 4.0.21, and 3.x before 3.23.49, allows attackers to cause a denial of service (crash or hang) via multiple threads that simultaneously alter MERGE table UNIONs.

CVSS 2.0 · 2.6 Low EPSS 4.9% KEV · Not listed
Vendors
Debian Mysql Oracle and 1 more
Products
Debian Linux Mysql Mysql and 2 more
CVE-2006-2426

Untrusted applet causes DoS by filling up disk space

Sun Java Runtime Environment (JRE) 1.5.0_6 and earlier, JDK 1.5.0_6 and earlier, and SDK 1.5.0_6 and earlier allows remote attackers to cause a denial of service (disk consumption) by using the Font.createFont function to create temporary files of arbitrary size in the %temp% directory.

CVSS 2.0 · 6.4 Medium EPSS 13.0% KEV · Not listed
Vendors
Redhat Sun
Products
Enterprise Linux Network Satellite Rhel Extras and 3 more
CVE-2006-0323

security flaw

Buffer overflow in swfformat.dll in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, Rhapsody 3, and Helix Player allows remote attackers to execute arbitrary code via a crafted SWF (Flash) file with (1) a size value that is less than the actual size, or (2) other unspecified manipulations.

CVSS 2.0 · 9.3 Critical EPSS 16.7% KEV · Not listed
Vendors
Realnetworks Redhat
Products
Helix Player Realone Player Realplayer and 2 more
CVE-2005-0611

security flaw

Heap-based buffer overflow in RealNetworks RealPlayer 10.5 (6.0.12.1056 and earlier), 10, 8, and RealOne Player V2 and V1, allows remote attackers to execute arbitrary code via .WAV files.

CVSS 2.0 · 5.1 Medium EPSS 3.8% KEV · Not listed
Vendors
Realnetworks Redhat
Products
Helix Player Realone Player Realplayer and 2 more
CVE-2004-0630

security flaw

The uudecoding feature in Adobe Acrobat Reader 5.0.5 and 5.0.6 for Unix and Linux, and possibly other versions including those before 5.0.9, allows remote attackers to execute arbitrary code via shell metacharacters ("`" or backtick) in the filename of the PDF file that is provided to the uudecode command.

CVSS 2.0 · 10.0 Critical EPSS 8.2% KEV · Not listed
Vendors
Adobe Redhat
Products
Acrobat Reader Rhel Extras
CVE-2006-0024

security flaw

Multiple unspecified vulnerabilities in Adobe Flash Player 8.0.22.0 and earlier allow remote attackers to execute arbitrary code via a crafted SWF file.

CVSS 2.0 · 5.1 Medium EPSS 6.8% KEV · Not listed
Vendors
Macromedia Redhat
Products
Flash Player Rhel Extras
CVE-2005-2922

security flaw

Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, and Helix Player allows remote malicious servers to cause a denial of service (crash) and possibly execute arbitrary code via a chunked Transfer-Encoding HTTP response in which either (1) the chunk header length is specified as -1, (2) the chunk header with a length that is less than the actual amount of sent data, or (3) a missing chunk header.

CVSS 2.0 · 9.3 Critical EPSS 5.8% KEV · Not listed
Vendors
Realnetworks Redhat
Products
Helix Player Realone Player Realplayer and 3 more
CVE-2005-0455

security flaw

Stack-based buffer overflow in the CSmil1Parser::testAttributeFailed function in smlparse.cpp for RealNetworks RealPlayer 10.5 (6.0.12.1056 and earlier), 10, 8, and RealOne Player V2 and V1 allows remote attackers to execute arbitrary code via a .SMIL file with a large system-screen-size value.

CVSS 2.0 · 5.1 Medium EPSS 54.0% KEV · Not listed
Vendors
Realnetworks Redhat
Products
Realone Player Realplayer Enterprise Linux and 1 more
CVE-2005-2710

security flaw

Format string vulnerability in Real HelixPlayer and RealPlayer 10 allows remote attackers to execute arbitrary code via the (1) image handle or (2) timeformat attribute in a RealPix (.rp) or RealText (.rt) file.

CVSS 2.0 · 5.1 Medium EPSS 13.2% KEV · Not listed
Vendors
Realnetworks Redhat
Products
Helix Player Realplayer Enterprise Linux and 1 more
CVE-2004-0387

security flaw

Stack-based buffer overflow in the RT3 plugin, as used in RealPlayer 8, RealOne Player, RealOne Player 10 beta, and RealOne Player Enterprise, allows remote attackers to execute arbitrary code via a malformed .R3T file.

CVSS 2.0 · 5.1 Medium EPSS 3.2% KEV · Not listed
Vendors
Realnetworks Redhat
Products
Realone Player Realplayer Rhel Extras