Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 615

Export CSV
CVE-2015-4902

JDK: unspecified vulnerability fixed in 6u105, 7u91 and 8u65 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

CVSS 3.1 · 5.3 Medium EPSS 13.6% KEV · Listed
Vendors
Opensuse Oracle Redhat and 1 more
Products
Leap Opensuse Jdk and 21 more
CVE-2015-4495

Mozilla: Same origin violation and local file stealing via PDF reader (MFSA 2015-78)

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

CVSS 3.1 · 8.8 High EPSS 68.6% KEV · Listed
Vendors
Canonical Mozilla Opensuse and 3 more
Products
Ubuntu Linux Firefox Firefox Os and 13 more
CVE-2012-0767

flash-plugin: universal cross-site scripting flaw (APSB12-03)

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

CVSS 3.1 · 6.1 Medium EPSS 6.2% KEV · Listed
Vendors
Adobe Apple Google and 4 more
Products
Flash Player Mac Os X Android and 4 more
CVE-2012-0754

flash-plugin: multiple code execution flaws (APSB12-03)

Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

CVSS 3.1 · 7.8 High EPSS 91.2% KEV · Listed
Vendors
Adobe Apple Google and 4 more
Products
Flash Player Mac Os X Android and 4 more
CVE-2011-0609

flash-plugin: crash and potential arbitrary code execution (APSB11-05)

Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.

CVSS 3.1 · 7.8 High EPSS 63.5% KEV · Listed
Vendors
Adobe Apple Google and 6 more
Products
Acrobat Acrobat Reader Air and 12 more
CVE-2011-0611

flash-plugin: crash and potential arbitrary code execution (APSB11-07)

Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.

CVSS 3.1 · 8.8 High EPSS 99.4% KEV · Listed
Vendors
Adobe Apple Google and 6 more
Products
Acrobat Acrobat Reader Adobe Air and 13 more
CVE-2014-0196

kernel: pty layer race condition leading to memory corruption

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.

CVSS 3.1 · 5.5 Medium EPSS 20.3% KEV · Listed
Vendors
Canonical Debian F5 and 4 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 30 more
CVE-2012-5076

OpenJDK: com.sun.org.glassfish.* not restricted packages (JAX-WS, 7163198)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.

CVSS 3.1 · 9.8 Critical EPSS 91.2% KEV · Listed
Vendors
Oracle Redhat Suse
Products
Jre Enterprise Linux Rhel Extras and 1 more
CVE-2015-2590

OpenJDK: deserialization issue in ObjectInputStream.readSerialData() (Libraries, 8076401)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

CVSS 3.1 · 9.8 Critical EPSS 25.5% KEV · Listed
Vendors
Canonical Debian Opensuse and 3 more
Products
Ubuntu Linux Debian Linux Opensuse and 22 more
CVE-2014-3153

kernel: futex: pi futexes requeue issue

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

CVSS 3.1 · 7.8 High EPSS 37.2% KEV · Listed
Vendors
Canonical Linux Opensuse and 3 more
Products
Ubuntu Linux Linux Kernel Opensuse and 10 more
CVE-2003-0150

security flaw

MySQL 3.23.55 and earlier creates world-writeable files and allows mysql users to gain root privileges by using the "SELECT * INFO OUTFILE" operator to overwrite a configuration file and cause mysql to run as root upon restart, as demonstrated by modifying my.cnf.

CVSS 2.0 · 9.0 Critical EPSS 44.8% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Enterprise Linux Linux
CVE-2002-0840

security flaw

Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.

CVSS 2.0 · 6.8 Medium EPSS 95.1% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Http Server Application Server Database Server and 6 more
CVE-2003-0073

security flaw

Double-free vulnerability in mysqld for MySQL before 3.23.55 allows attackers with MySQL access to cause a denial of service (crash) via mysql_change_user.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Enterprise Linux Linux
CVE-2002-1376

security flaw

libmysqlclient client library in MySQL 3.x to 3.23.54, and 4.x to 4.0.6, does not properly verify length fields for certain responses in the (1) read_rows or (2) read_one_row routines, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.

CVSS 2.0 · 7.5 High EPSS 6.8% KEV · Not listed
Vendors
Oracle Redhat Symantec Veritas
Products
Mysql Enterprise Linux Linux and 3 more
CVE-2001-1275

security flaw

MySQL before 3.23.31 allows users with a MySQL account to use the SHOW GRANTS command to obtain the encrypted administrator password from the mysql.user table and possibly gain privileges via password cracking.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Linux
CVE-2002-1374

security flaw

The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x before 4.0.6, allows remote attackers to gain privileges via a brute force attack using a one-character password, which causes MySQL to only compare the provided password against the first character of the real password.

CVSS 2.0 · 7.5 High EPSS 20.5% KEV · Not listed
Vendors
Oracle Redhat Symantec Veritas
Products
Mysql Enterprise Linux Linux and 2 more
CVE-2002-0656

security flaw

Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.

CVSS 2.0 · 7.5 High EPSS 89.8% KEV · Not listed
Vendors
Apple Openssl Oracle and 1 more
Products
Mac Os X Openssl Application Server and 5 more
CVE-2002-1373

security flaw

Signed integer vulnerability in the COM_TABLE_DUMP package for MySQL 3.23.x before 3.23.54 allows remote attackers to cause a denial of service (crash or hang) in mysqld by causing large negative integers to be provided to a memcpy call.

CVSS 2.0 · 5.0 Medium EPSS 3.6% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Enterprise Linux Linux