Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 157

Export CSV
CVE-2015-7976

ntp: 'ntpq saveconfig' command allows dangerous characters in filenames

The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.

CVSS 3.0 · 4.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Novell Ntp Opensuse and 1 more
Products
Suse Openstack Cloud Ntp Leap and 7 more
CVE-2017-1000366

glibc: heap/stack gap jumping via unbounded stack allocations

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

CVSS 3.0 · 7.8 High EPSS 2.7% KEV · Not listed
Vendors
Debian Gnu Mcafee and 5 more
Products
Debian Linux Glibc Web Gateway and 23 more
CVE-2015-2710

Mozilla: Buffer overflow with SVG content and CSS (MFSA 2015-48)

Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets (CSS) token sequence.

CVSS 2.0 · 6.8 Medium EPSS 4.4% KEV · Not listed
Vendors
Mozilla Novell Opensuse and 1 more
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2015-2713

Mozilla: Use-after-free during text processing with vertical text enabled (MFSA 2015-51)

Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing crafted text in conjunction with a Cascading Style Sheets (CSS) token sequence containing properties related to vertical text.

CVSS 2.0 · 6.8 Medium EPSS 3.7% KEV · Not listed
Vendors
Mozilla Novell Opensuse and 1 more
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2015-2709

Mozilla: Miscellaneous memory safety hazards (rv:38.0) (MFSA 2015-46)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 4.2% KEV · Not listed
Vendors
Mozilla Novell Opensuse
Products
Firefox Suse Linux Enterprise Desktop Suse Linux Enterprise Server and 2 more
CVE-2015-2716

expat: Integer overflow leading to buffer overflow in XML_GetBuffer()

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.

CVSS 2.0 · 7.5 High EPSS 7.2% KEV · Not listed
Vendors
Mozilla Novell Opensuse and 2 more
Products
Firefox Firefox Esr Thunderbird and 8 more
CVE-2015-0395

OpenJDK: phantom references handling issue in garbage collector (Hotspot, 8047125)

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS 2.0 · 9.3 Critical EPSS 5.9% KEV · Not listed
Vendors
Canonical Debian Novell and 3 more
Products
Ubuntu Linux Debian Linux Suse Linux Enterprise Server and 7 more
CVE-2015-0383

OpenJDK: insecure hsperfdata temporary file handling (Hotspot, 8050807)

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot.

CVSS 2.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2015-2567

mysql: unspecified vulnerability related to Server:Security:Privileges (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.

CVSS 2.0 · 3.5 Low EPSS 2.5% KEV · Not listed
Vendors
Novell Oracle
Products
Suse Linux Suse Linux For Vmware Suse Linux Sdk and 1 more
CVE-2015-0403

JDK: unspecified vulnerability fixed in 6u91, 7u75 and 8u31 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Novell Oracle Redhat
Products
Suse Linux Enterprise Desktop Jdk Jre and 3 more
CVE-2014-9904

kernel: Integer overflow in snd_compr_allocate_buffer()

The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Novell
Products
Debian Linux Linux Kernel Suse Linux Enterprise Real Time Extension
CVE-2015-0406

JDK: unspecified vulnerability fixed in 6u91, 7u75 and 8u31 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment.

CVSS 2.0 · 5.8 Medium EPSS 3.9% KEV · Not listed
Vendors
Novell Oracle Redhat
Products
Suse Linux Enterprise Desktop Jdk Jre and 3 more
CVE-2014-8559

kernel: fs: deadlock due to incorrect usage of rename_lock

The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to cause a denial of service (deadlock and system hang) via a crafted application.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Novell and 4 more
Products
Ubuntu Linux Linux Kernel Suse Linux Enterprise Desktop and 11 more
CVE-2015-0410

OpenJDK: DER decoder infinite loop (Security, 8059485)

Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security.

CVSS 2.0 · 5.0 Medium EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Novell and 3 more
Products
Ubuntu Linux Debian Linux Suse Linux Enterprise Desktop and 9 more
CVE-2015-2708

Mozilla: Miscellaneous memory safety hazards (rv:31.7) (MFSA 2015-46)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 4.5% KEV · Not listed
Vendors
Mozilla Novell Opensuse and 1 more
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2015-2721

NSS: incorrectly permited skipping of ServerKeyExchange (MFSA 2015-71)

Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attackers to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue.

CVSS 2.0 · 4.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 9 more