Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6,068

Export CSV
CVE-2011-4862

krb5: telnet client and server encrypt_keyid heap-based buffer overflow

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.

CVSS 2.0 · 10.0 Critical EPSS 95.1% KEV · Not listed
Vendors
Debian Fedoraproject Freebsd and 6 more
Products
Debian Linux Fedora Freebsd and 11 more
CVE-2009-4271

kernel: 32bit process on 64bit system can trigger a kernel panic

The Linux kernel 2.6.9 through 2.6.17 on the x86_64 and amd64 platforms allows local users to cause a denial of service (panic) via a 32-bit application that calls mprotect on its Virtual Dynamic Shared Object (VDSO) page and then triggers a segmentation fault.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2012-0028

kernel: futex: clear robust_list on execve

The robust futex implementation in the Linux kernel before 2.6.28 does not properly handle processes that make exec system calls, which allows local users to cause a denial of service or possibly gain privileges by writing to a memory location in a child process.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus
CVE-2012-0031

httpd: possible crash on shutdown due to flaw in scoreboard handling

scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.

CVSS 2.0 · 4.6 Medium EPSS 2.8% KEV · Not listed
Vendors
Apache Debian Opensuse and 2 more
Products
Http Server Debian Linux Opensuse and 10 more
CVE-2012-0038

kernel: xfs heap overflow

Integer overflow in the xfs_acl_from_disk function in fs/xfs/xfs_acl.c in the Linux kernel before 3.1.9 allows local users to cause a denial of service (panic) via a filesystem with a malformed ACL, leading to a heap-based buffer overflow.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2012-0044

kernel: drm: integer overflow in drm_mode_dirtyfb_ioctl()

Integer overflow in the drm_mode_dirtyfb_ioctl function in drivers/gpu/drm/drm_crtc.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.1.5 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted ioctl call.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 2 more
CVE-2012-0045

kernel: kvm: syscall instruction induced guest panic

The em_syscall function in arch/x86/kvm/emulate.c in the KVM implementation in the Linux kernel before 3.2.14 does not properly handle the 0f05 (aka syscall) opcode, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application, as demonstrated by an NASM file.

CVSS 2.0 · 4.7 Medium EPSS 1.0% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2012-0053

httpd: cookie exposure due to error responses

protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.

CVSS 2.0 · 4.3 Medium EPSS 82.2% KEV · Not listed
Vendors
Apache Debian Opensuse and 2 more
Products
Http Server Debian Linux Opensuse and 9 more
CVE-2012-0056

kernel: proc: /proc/<pid>/mem mem_write insufficient permission checking

The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper.

CVSS 2.0 · 6.9 Medium EPSS 10.8% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg
CVE-2012-0207

kernel: igmp: Avoid zero delay when receiving odd mixture of IGMP queries

The igmp_heard_query function in net/ipv4/igmp.c in the Linux kernel before 3.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and panic) via IGMP packets.

CVSS 3.1 · 7.5 High EPSS 20.3% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Eus and 1 more
CVE-2012-0442

Mozilla: memory safety hazards in 10.0/1.9.2.26 (MFSA 2012-01)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 9.3 Critical EPSS 4.5% KEV · Not listed
Vendors
Debian Mozilla Opensuse and 2 more
Products
Debian Linux Firefox Seamonkey and 6 more
CVE-2012-0444

Firefox: Ogg Vorbis Decoding Memory Corruption (MFSA 2012-07)

Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file.

CVSS 2.0 · 10.0 Critical EPSS 7.8% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 7 more
CVE-2012-0449

Mozilla: Crash when rendering SVG+XSLT (MFSA 2012-08)

Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a malformed XSLT stylesheet that is embedded in a document.

CVSS 2.0 · 9.3 Critical EPSS 5.7% KEV · Not listed
Vendors
Debian Mozilla Opensuse and 2 more
Products
Debian Linux Firefox Seamonkey and 6 more
CVE-2010-2803

kernel: drm ioctls infoleak

The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Debian Linux Opensuse and 2 more
Products
Debian Linux Linux Kernel Opensuse and 5 more
CVE-2012-0752

flash-plugin: multiple code execution flaws (APSB12-03)

Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) by leveraging an unspecified "type confusion."

CVSS 2.0 · 9.3 Critical EPSS 8.8% KEV · Not listed
Vendors
Adobe Apple Google and 4 more
Products
Flash Player Mac Os X Android and 4 more
CVE-2012-0753

flash-plugin: multiple code execution flaws (APSB12-03)

Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted MP4 data.

CVSS 2.0 · 9.3 Critical EPSS 4.2% KEV · Not listed
Vendors
Adobe Apple Google and 4 more
Products
Flash Player Mac Os X Android and 4 more
CVE-2010-2798

kernel: gfs2: rename causes kernel panic

The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact by renaming a file in a GFS2 filesystem, related to the gfs2_rename function in fs/gfs2/ops_inode.c.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Avaya Canonical Debian and 5 more
Products
Aura Communication Manager Aura Presence Services Aura Session Manager and 14 more
CVE-2012-0755

flash-plugin: multiple code execution flaws (APSB12-03)

Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2012-0756.

CVSS 2.0 · 9.3 Critical EPSS 4.5% KEV · Not listed
Vendors
Adobe Apple Google and 4 more
Products
Flash Player Mac Os X Android and 4 more
CVE-2012-0756

flash-plugin: multiple code execution flaws (APSB12-03)

Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2012-0755.

CVSS 2.0 · 9.3 Critical EPSS 14.1% KEV · Not listed
Vendors
Adobe Apple Google and 4 more
Products
Flash Player Mac Os X Android and 4 more
CVE-2010-2753

Mozilla nsTreeSelection dangling pointer remote code execution vulnerability

Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code via a large selection attribute in a XUL tree element, which triggers a use-after-free.

CVSS 3.1 · 8.8 High EPSS 6.7% KEV · Not listed
Vendors
Mozilla Opensuse Redhat and 1 more
Products
Firefox Seamonkey Thunderbird and 5 more