Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,292

Export CSV
CVE-2016-0668

mysql: unspecified vulnerability in subcomponent: Server: InnoDB (CPU April 2016)

Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to InnoDB.

CVSS 3.1 · 4.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Canonical Debian Mariadb and 4 more
Products
Ubuntu Linux Debian Linux Mariadb and 8 more
CVE-2016-1672

chromium-browser: cross-origin bypass in extension bindings

The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles properties, which allows remote attackers to conduct bindings-interception attacks and bypass the Same Origin Policy via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Chrome Leap and 6 more
CVE-2015-8933

libarchive: Undefined behavior / signed integer overflow in TAR parser

Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file.

CVSS 3.0 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Libarchive Suse
Products
Ubuntu Linux Libarchive Linux Enterprise Desktop and 2 more
CVE-2015-8934

libarchive: out of bounds heap read in RAR parser

The copy_from_lzss_window function in archive_read_support_format_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted rar file.

CVSS 3.0 · 5.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Libarchive Redhat and 1 more
Products
Ubuntu Linux Libarchive Enterprise Linux and 3 more
CVE-2015-8932

libarchive: Undefined behavior / invalid shiftleft in TAR parser

The compress_bidder_init function in archive_read_support_filter_compress.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file, which triggers an invalid left shift.

CVSS 3.0 · 5.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Libarchive and 2 more
Products
Ubuntu Linux Debian Linux Libarchive and 4 more
CVE-2016-0264

JDK: buffer overflow vulnerability in the IBM JVM

Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 3.1 · 5.6 Medium EPSS 3.9% KEV · Not listed
Vendors
Ibm Redhat Suse
Products
Java Sdk Enterprise Linux Desktop Enterprise Linux Hpc Node Supplementary and 12 more
CVE-2015-8931

libarchive: Undefined behavior (signed integer overflow) in mtree parser

Multiple integer overflows in the (1) get_time_t_max and (2) get_time_t_min functions in archive_read_support_format_mtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Libarchive and 2 more
Products
Ubuntu Linux Debian Linux Libarchive and 4 more
CVE-2016-0642

mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU April 2016)

Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors related to Federated.

CVSS 3.1 · 4.7 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Mariadb and 4 more
Products
Ubuntu Linux Debian Linux Mariadb and 16 more
CVE-2015-8866

php: libxml_disable_entity_loader setting is shared between threads

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

CVSS 3.1 · 9.6 Critical EPSS 4.2% KEV · Not listed
Vendors
Canonical Opensuse Php and 2 more
Products
Ubuntu Linux Leap Opensuse and 4 more
CVE-2015-8925

libarchive: Unclear invalid memory read in mtree parser

The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing.

CVSS 3.0 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Libarchive Redhat and 1 more
Products
Ubuntu Linux Libarchive Enterprise Linux and 3 more
CVE-2015-8845

kernel: incorrect restoration of machine specific registers from userspace

The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Novell Redhat and 1 more
Products
Linux Kernel Suse Linux Enterprise Desktop Suse Linux Enterprise Server and 7 more
CVE-2015-8926

libarchive: NULL pointer access in RAR parser

The archive_read_format_rar_read_data function in archive_read_support_format_rar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted rar archive.

CVSS 3.0 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Libarchive Redhat and 1 more
Products
Ubuntu Linux Libarchive Enterprise Linux and 3 more
CVE-2015-8816

kernel: USB hub invalid memory access in hub_activate()

The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Novell Suse
Products
Linux Kernel Suse Linux Enterprise Debuginfo Suse Linux Enterprise Desktop and 8 more
CVE-2015-8928

libarchive: Heap out of bounds read in mtree parser

The process_add_entry function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mtree file.

CVSS 3.0 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Libarchive Redhat and 1 more
Products
Ubuntu Linux Libarchive Enterprise Linux and 3 more
CVE-2016-0651

mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Mariadb Opensuse Oracle and 2 more
Products
Mariadb Leap Opensuse and 14 more
CVE-2016-1673

chromium-browser: cross-origin bypass in blink

Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 7 more
CVE-2015-8776

glibc: Segmentation fault caused by passing out-of-range data to strftime()

The strftime function in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly obtain sensitive information via an out-of-range time value.

CVSS 3.0 · 9.1 Critical EPSS 4.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2015-8778

glibc: Integer overflow in hcreate and hcreate_r

Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access.

CVSS 3.0 · 9.8 Critical EPSS 5.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more