Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2014-4975

ruby: off-by-one stack-based buffer overflow in the encodes() function

Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 6 more
CVE-2016-5626

mysql: unspecified vulnerability in subcomponent: Server: GIS (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to GIS.

CVSS 3.1 · 6.5 Medium EPSS 6.3% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 5 more
CVE-2016-5624

mysql: unspecified vulnerability in subcomponent: Server: DML (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows remote authenticated users to affect availability via vectors related to DML.

CVSS 3.1 · 6.5 Medium EPSS 5.1% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 7 more
CVE-2015-4602

php: Incomplete Class unserialization type confusion

The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

CVSS 3.0 · 9.8 Critical EPSS 10.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2014-4721

php: type confusion issue in phpinfo() leading to information leak

The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a "type confusion" vulnerability, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php.

CVSS 2.0 · 2.6 Low EPSS 5.9% KEV · Not listed
Vendors
Debian Php Redhat
Products
Debian Linux Php Enterprise Linux and 1 more
CVE-2015-4601

php: type confusion issue in unserialize() with various SOAP methods

PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.

CVSS 3.0 · 9.8 Critical EPSS 7.9% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2016-5612

mysql: unspecified vulnerability in subcomponent: Server: DML (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31 and earlier, and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML.

CVSS 3.1 · 6.5 Medium EPSS 3.7% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 7 more
CVE-2016-5609

mysql: unspecified vulnerability in subcomponent: Server: DML (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML.

CVSS 3.1 · 6.5 Medium EPSS 3.3% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Rhel Software Collections
CVE-2015-4600

php: type confusion issue in unserialize() with various SOAP methods

The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the (1) SoapClient::__getLastRequest, (2) SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4) SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods.

CVSS 3.0 · 9.8 Critical EPSS 10.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2016-5507

mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.6.32 and earlier and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.

CVSS 3.1 · 4.9 Medium EPSS 2.8% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Rhel Software Collections
CVE-2015-4599

php: type confusion issue in unserialize() with various SOAP methods

The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

CVSS 3.0 · 9.8 Critical EPSS 10.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2014-4698

php: ArrayIterator use-after-free due to object change during sorting

Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting environments.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Software Collections
CVE-2014-0384

mysql: unspecified DoS related to XML (CPU April 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to XML.

CVSS 2.0 · 4.0 Medium EPSS 3.3% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 7 more
CVE-2016-5444

mysql: unspecified vulnerability in subcomponent: Server: Connection (CPU July 2016)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Connection.

CVSS 3.0 · 3.7 Low EPSS 4.3% KEV · Not listed
Vendors
Ibm Mariadb Oracle and 1 more
Products
Powerkvm Mariadb Linux and 9 more
CVE-2016-5440

mysql: unspecified vulnerability in subcomponent: Server: RBR (CPU July 2016)

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR.

CVSS 3.0 · 4.9 Medium EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Ibm and 3 more
Products
Ubuntu Linux Debian Linux Powerkvm and 11 more
CVE-2015-4598

php: missing null byte checks for paths in DOM and GD extensions

PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument save method or (2) the GD imagepsloadfont function, as demonstrated by a filename\0.html attack that bypasses an intended configuration in which client users may write to only .html files.

CVSS 3.0 · 6.5 Medium EPSS 3.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2016-5439

mysql: unspecified vulnerability in subcomponent: Server: Privileges (CPU July 2016)

Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote administrators to affect availability via vectors related to Server: Privileges.

CVSS 3.0 · 4.9 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Mysql Rhel Software Collections
CVE-2016-5424

postgresql: privilege escalation via crafted database and role names

PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation.

CVSS 3.0 · 7.1 High EPSS 4.6% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 2 more
CVE-2015-4148

php: SoapClient's do_soap_call() type confusion after unserialize()

The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.

CVSS 2.0 · 5.0 Medium EPSS 19.8% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2014-4670

php: SPL Iterators use-after-free

Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Software Collections