Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,064

Export CSV
CVE-2013-6425

pixman: integer underflow when handling trapezoids

Integer underflow in the pixman_trapezoid_valid macro in pixman.h in Pixman before 0.32.0, as used in X.Org server and cairo, allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.

CVSS 2.0 · 5.0 Medium EPSS 2.9% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Opensuse and 8 more
CVE-2013-5908

mysql: unspecified vulnerability related to Error Handling DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote attackers to affect availability via unknown vectors related to Error Handling.

CVSS 2.0 · 2.6 Low EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2013-5843

JDK: unspecified vulnerability fixed in 7u45 (2D)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JavaFX 2.2.40 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 6.1% KEV · Not listed
Vendors
Oracle Redhat
Products
Javafx Jdk Jre and 8 more
CVE-2012-0867

postgresql: MITM due improper x509_v3 CN validation during certificate verification

PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

CVSS 2.0 · 4.3 Medium EPSS 2.3% KEV · Not listed
Vendors
Debian Opensuse Project Postgresql and 1 more
Products
Debian Linux Opensuse Postgresql and 8 more
CVE-2012-0248

ImageMagick: invalid validation of images denial of service

ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted image whose IFD contains IOP tags that all reference the beginning of the IDF.

CVSS 3.1 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Imagemagick and 1 more
Products
Ubuntu Linux Debian Linux Imagemagick and 8 more
CVE-2012-0247

ImageMagick: invalid validation of images denial of service

ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset and count values in the ResolutionUnit tag in the EXIF IFD0 of an image.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Imagemagick and 1 more
Products
Ubuntu Linux Debian Linux Imagemagick and 8 more
CVE-2012-0037

raptor: XML External Entity (XXE) attack via RDF files

Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.

CVSS 3.1 · 6.5 Medium EPSS 13.5% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 3 more
Products
Openoffice Debian Linux Fedora and 11 more
CVE-2013-5842

OpenJDK: ObjectInputStream/ObjectOutputStream missing checks (Libraries, 8014987)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-5850.

CVSS 2.0 · 10.0 Critical EPSS 17.6% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Jdk Jre and 9 more
CVE-2013-5830

OpenJDK: checkPackageAccess missing security check (Libraries, 8017291)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0 · 10.0 Critical EPSS 7.2% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Jdk Jre and 10 more
CVE-2013-5829

OpenJDK: Java2d Disposer security bypass (2D, 8017287)

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-5809.

CVSS 2.0 · 10.0 Critical EPSS 7.2% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Jdk Jre and 9 more
CVE-2013-1544

mysql: unspecified DoS related to Data Manipulation Language (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language.

CVSS 2.0 · 4.0 Medium EPSS 2.3% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 5 more
CVE-2013-5614

Mozilla: Sandbox restrictions not applied to nested object elements (MFSA 2013-107)

Mozilla Firefox before 26.0 and SeaMonkey before 2.23 do not properly consider the sandbox attribute of an IFRAME element during processing of a contained OBJECT element, which allows remote attackers to bypass intended sandbox restrictions via a crafted web site.

CVSS 2.0 · 4.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 4 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2013-5612

Mozilla: Character encoding cross-origin XSS attack (MFSA 2013-106)

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 makes it easier for remote attackers to inject arbitrary web script or HTML by leveraging a Same Origin Policy violation triggered by lack of a charset parameter in a Content-Type HTTP header.

CVSS 2.0 · 4.3 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Fedoraproject Mozilla and 4 more
Products
Ubuntu Linux Fedora Firefox and 14 more
CVE-2013-2555

flash-plugin: Remote attackers able to execute arbitrary code via vectors that leverage an 'overflow' (CanSecWest 2013)

Integer overflow in Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.

CVSS 2.0 · 10.0 Critical EPSS 8.5% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Air Flash Player Macos and 11 more
CVE-2013-2391

mysql: unspecified vulnerability related to Server Install (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows local users to affect confidentiality and integrity via unknown vectors related to Server Install.

CVSS 2.0 · 3.0 Low EPSS < 1% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 5 more
CVE-2013-2378

mysql: unspecified vulnerability related to Information Schema (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, 5.5.29 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Information Schema.

CVSS 2.0 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 5 more
CVE-2013-2375

mysql: unspecified vulnerability related to Server Privileges (CPU April 2013)

Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.

CVSS 2.0 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 5 more
CVE-2013-1896

httpd: mod_dav DoS (httpd child process crash) via a URI MERGE request with source URI not handled by mod_dav

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.

CVSS 2.0 · 4.3 Medium EPSS 29.5% KEV · Not listed
Vendors
Apache Canonical Opensuse and 1 more
Products
Http Server Ubuntu Linux Opensuse and 8 more
CVE-2013-1862

httpd: mod_rewrite allows terminal escape sequences to be written to the log file

mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.

CVSS 2.0 · 5.1 Medium EPSS 24.9% KEV · Not listed
Vendors
Apache Canonical Opensuse and 2 more
Products
Http Server Ubuntu Linux Opensuse and 9 more
CVE-2013-1620

nss: TLS CBC padding timing attack

The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

CVSS 2.0 · 4.3 Medium EPSS 3.7% KEV · Not listed
Vendors
Canonical Mozilla Oracle and 1 more
Products
Ubuntu Linux Network Security Services Enterprise Manager Ops Center and 13 more