Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 900

Export CSV
CVE-2015-2575

mysql-connector-java: unspecified vulnerability related to Connector/J (CPU April 2015)

Unspecified vulnerability in the MySQL Connectors component in Oracle MySQL 5.1.34 and earlier allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Connector/J.

CVSS 2.0 · 4.9 Medium EPSS 3.6% KEV · Not listed
Vendors
Debian Mysql Suse
Products
Debian Linux Mysql Linux Enterprise Desktop and 2 more
CVE-2015-2576

mysql-utilities: unspecified vulnerability related to Installation (CPU April 2015)

Unspecified vulnerability in the MySQL Utilities component in Oracle MySQL 1.5.1 and earlier, when running on Windows, allows local users to affect integrity via unknown vectors related to Installation.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Oracle Suse
Products
Mysql Linux Enterprise Desktop Linux Enterprise Server and 1 more
CVE-2015-2695

krb5: SPNEGO context aliasing bugs

lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.

CVSS 2.0 · 5.0 Medium EPSS 6.0% KEV · Not listed
Vendors
Canonical Debian Mit and 3 more
Products
Ubuntu Linux Debian Linux Kerberos 5 and 6 more
CVE-2015-2696

krb5: IAKERB context aliasing flaw

lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.

CVSS 2.0 · 7.1 High EPSS 4.5% KEV · Not listed
Vendors
Canonical Debian Mit and 2 more
Products
Ubuntu Linux Debian Linux Kerberos 5 and 5 more
CVE-2015-2697

krb5: build_principal() memory flaw

The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.

CVSS 2.0 · 4.0 Medium EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Mit and 3 more
Products
Ubuntu Linux Debian Linux Kerberos 5 and 6 more
CVE-2015-2734

Mozilla: Vulnerabilities found through code inspection (MFSA 2015-66)

The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.

CVSS 2.0 · 10.0 Critical EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 8 more
CVE-2015-2737

Mozilla: Vulnerabilities found through code inspection (MFSA 2015-66)

The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.

CVSS 2.0 · 10.0 Critical EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 8 more
CVE-2015-2738

Mozilla: Vulnerabilities found through code inspection (MFSA 2015-66)

The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors.

CVSS 2.0 · 10.0 Critical EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 8 more
CVE-2014-0564

flash-plugin: multiple code execution flaws (APSB14-22)

Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0558.

CVSS 2.0 · 10.0 Critical EPSS 6.2% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Air Desktop Runtime Air Sdk Flash Player and 12 more
CVE-2015-3038

flash-plugin: multiple code execution issues fixed in APSB15-06

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.

CVSS 2.0 · 10.0 Critical EPSS 7.0% KEV · Not listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Mac Os X Linux Kernel and 9 more
CVE-2015-3039

flash-plugin: multiple code execution issues fixed in APSB15-06

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0349, CVE-2015-0351, and CVE-2015-0358.

CVSS 2.0 · 10.0 Critical EPSS 7.8% KEV · Not listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Mac Os X Linux Kernel and 9 more
CVE-2015-3040

flash-plugin: information leaks leading to ASLR bypass (APSB15-06)

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-0357.

CVSS 2.0 · 5.0 Medium EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Mac Os X Linux Kernel and 9 more
CVE-2015-3041

flash-plugin: multiple code execution issues fixed in APSB15-06

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3042, and CVE-2015-3043.

CVSS 2.0 · 10.0 Critical EPSS 6.0% KEV · Not listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Mac Os X Linux Kernel and 9 more
CVE-2015-3042

flash-plugin: multiple code execution issues fixed in APSB15-06

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3043.

CVSS 2.0 · 10.0 Critical EPSS 36.8% KEV · Not listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Mac Os X Linux Kernel and 9 more
CVE-2014-0569

flash-plugin: multiple code execution flaws (APSB14-22)

Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allows attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 9.3 Critical EPSS 91.3% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Air Desktop Runtime Air Sdk Flash Player and 12 more
CVE-2015-3195

OpenSSL: X509_ATTRIBUTE memory leak

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

CVSS 3.1 · 5.3 Medium EPSS 38.7% KEV · Not listed
Vendors
Apple Canonical Debian and 6 more
Products
Mac Os X Ubuntu Linux Debian Linux and 25 more
CVE-2015-3209

qemu: pcnet: multi-tmd buffer overflow in the tx path

Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set.

CVSS 2.0 · 7.5 High EPSS 9.7% KEV · Not listed
Vendors
Arista Canonical Debian and 5 more
Products
Eos Ubuntu Linux Debian Linux and 17 more
CVE-2015-3281

haproxy: information leak in buffer_slow_realign()

The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Haproxy and 3 more
Products
Ubuntu Linux Debian Linux Haproxy and 11 more
CVE-2015-3340

xen: information leak through XEN_DOMCTL_gettscinfo (xsa132)

Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

CVSS 2.0 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Opensuse and 2 more
Products
Debian Linux Fedora Opensuse and 6 more
CVE-2014-0069

kernel: cifs: incorrect handling of bogus user pointers during uncached writes

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat Suse
Products
Linux Kernel Enterprise Linux Enterprise Linux Desktop and 8 more