Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2016-7167

curl: escape and unescape integer overflows

Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.

CVSS 3.0 · 9.8 Critical EPSS 11.7% KEV · Not listed
Vendors
Fedoraproject Haxx Redhat
Products
Fedora Libcurl Enterprise Linux and 2 more
CVE-2016-7416

php: Stack based buffer overflow in msgfmt_format_message

ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to the Locale class in the ICU library, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a MessageFormatter::formatMessage call with a long first argument.

CVSS 3.0 · 7.5 High EPSS 6.7% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-7417

php: Missing type check when unserializing SplArray

ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.

CVSS 3.0 · 9.8 Critical EPSS 6.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-7418

php: Null pointer dereference in php_wddx_push_element

The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service (invalid pointer access and out-of-bounds read) or possibly have unspecified other impact via an incorrect boolean element in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.

CVSS 3.0 · 7.5 High EPSS 11.4% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-7141

curl: Incorrect reuse of client certificates

curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.

CVSS 3.0 · 7.5 High EPSS 8.2% KEV · Not listed
Vendors
Haxx Opensuse Redhat
Products
Libcurl Leap Enterprise Linux and 2 more
CVE-2016-8283

mysql: unspecified vulnerability in subcomponent: Server: Types (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types.

CVSS 3.0 · 4.3 Medium EPSS 7.0% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 1 more
CVE-2015-4816

mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.

CVSS 2.0 · 4.0 Medium EPSS 7.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2016-7132

php: wddx_deserialize null dereference in php_wddx_pop_element

ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.

CVSS 3.1 · 7.5 High EPSS 8.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-7131

php: wddx_deserialize null dereference with invalid xml

ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a tag that lacks a < (less than) character.

CVSS 3.1 · 7.5 High EPSS 8.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2015-4815

mysql: unspecified vulnerability related to Server:DDL (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL.

CVSS 2.0 · 4.0 Medium EPSS 3.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 14 more
CVE-2015-4861

mysql: unspecified vulnerability related to Server:InnoDB (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.

CVSS 2.0 · 3.5 Low EPSS 3.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 14 more
CVE-2014-6520

mysql: unspecified vulnerability related to SERVER:DDL (CPU October 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:DDL.

CVSS 2.0 · 4.0 Medium EPSS 2.7% KEV · Not listed
Vendors
Mariadb Oracle Redhat and 1 more
Products
Mariadb Mysql Enterprise Linux and 6 more
CVE-2014-1402

python-jinja2: FileSystemBytecodeCache insecure cache temporary file use

The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pocoo Redhat
Products
Jinja2 Enterprise Linux Rhel Software Collections
CVE-2016-7130

php: wddx_deserialize null dereference

The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.

CVSS 3.0 · 7.5 High EPSS 6.7% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-7129

php: wddx_deserialize allows illegal memory access

The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.

CVSS 3.0 · 9.8 Critical EPSS 6.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2015-4802

mysql: unspecified vulnerability related to Server:Partition (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792.

CVSS 2.0 · 4.0 Medium EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 14 more
CVE-2016-7128

php: Memory Leakage In exif_process_IFD_in_TIFF

The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.

CVSS 3.0 · 5.3 Medium EPSS 7.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-7127

php: imagegammacorrect allows arbitrary write access

The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.

CVSS 3.0 · 9.8 Critical EPSS 6.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2015-4800

mysql: unspecified vulnerability related to Server:Optimizer (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 2.3% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Enterprise Linux Rhel Software Collections