Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,030

Export CSV
CVE-2016-5018

tomcat: security manager bypass via IntrospectHelper utility function

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

CVSS 3.1 · 9.1 Critical EPSS 10.3% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Tomcat Ubuntu Linux Debian Linux and 13 more
CVE-2016-0762

tomcat: timing attack in Realm implementation

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.

CVSS 3.1 · 5.9 Medium EPSS 8.0% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Tomcat Ubuntu Linux Debian Linux and 13 more
CVE-2018-1060

python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

CVSS 3.1 · 7.5 High EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2018-14647

python: Missing salt initialization in _elementtree.c module

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

CVSS 3.1 · 7.5 High EPSS 10.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2018-15982

flash-plugin: Arbitrary Code Execution vulnerability (APSB18-42)

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS 89.6% KEV · Listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Installer Mac Os X and 9 more
CVE-2020-6851

openjpeg: Heap-based buffer overflow in opj_t1_clbl_decode_processor()

OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed
Vendors
Debian Fedoraproject Oracle and 2 more
Products
Debian Linux Fedora Georaster and 10 more
CVE-2015-5287

abrt: incorrect permissions on /var/spool/abrt

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

CVSS 3.1 · 7.8 High EPSS 5.0% KEV · Listed
Vendors
Oracle Redhat
Products
Linux Automatic Bug Reporting Tool Enterprise Linux and 4 more
CVE-2017-12617

tomcat: Remote Code Execution bypass for CVE-2017-12615

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CVSS 3.1 · 8.1 High EPSS 100.0% KEV · Listed
Vendors
Apache Canonical Debian and 3 more
Products
Tomcat Ubuntu Linux Debian Linux and 57 more
CVE-2024-1086

Use-after-free in Linux kernel's netfilter: nf_tables component

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

CVSS 3.1 · 7.8 High EPSS 28.1% KEV · Listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 32 more
CVE-2018-3639

hw: cpu: speculative store bypass

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.

CVSS 3.1 · 5.5 Medium EPSS 60.4% KEV · Not listed
Vendors
Arm Canonical Debian and 9 more
Products
Cortex-a Ubuntu Linux Debian Linux and 327 more
CVE-2018-13785

libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service

In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.

CVSS 3.1 · 6.5 Medium EPSS 4.4% KEV · Not listed
Vendors
Canonical Libpng Oracle and 1 more
Products
Ubuntu Linux Libpng Jdk and 7 more
CVE-2016-1908

openssh: possible fallback from untrusted to trusted X11 forwarding

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

CVSS 3.1 · 9.8 Critical EPSS 13.7% KEV · Not listed
Vendors
Debian Openbsd Oracle and 1 more
Products
Debian Linux Openssh Linux and 7 more
CVE-2019-11135

hw: TSX Transaction Asynchronous Abort (TAA)

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.

CVSS 3.1 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 309 more
CVE-2017-15906

openssh: Improper write operations in readonly mode allow for zero-length file creation

The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

CVSS 3.1 · 5.3 Medium EPSS 3.4% KEV · Not listed
Vendors
Debian Netapp Openbsd and 2 more
Products
Debian Linux Active Iq Unified Manager Cloud Backup and 20 more
CVE-2014-3566

SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

CVSS 3.1 · 3.4 Low EPSS 100.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 8 more
Products
Mac Os X Debian Linux Fedora and 25 more
CVE-2015-2808

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

CVSS 3.1 · 3.7 Low EPSS 73.9% KEV · Not listed
Vendors
Canonical Debian Fujitsu and 6 more
Products
Ubuntu Linux Debian Linux Sparc Enterprise M3000 and 99 more
CVE-2015-0192

JDK: unspecified Java sandbox restrictions bypass

Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to gain privileges via unknown vectors related to the Java Virtual Machine.

CVSS 3.1 · 9.8 Critical EPSS 4.1% KEV · Not listed
Vendors
Ibm Redhat Suse
Products
Java Enterprise Linux Desktop Enterprise Linux Server and 7 more