Export limit exceeded: 425860 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2014-3669

php: integer overflow in unserialize()

Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function that triggers calculation of a large length value.

CVSS 2.0 · 7.5 High EPSS 28.9% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Eus and 1 more
CVE-2016-2098

rubygem-actionpack: code injection vulnerability in Action View

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

CVSS 3.0 · 7.3 High EPSS 81.4% KEV · Not listed
Vendors
Debian Redhat Rubyonrails
Products
Debian Linux Rhel Software Collections Rails and 1 more
CVE-2016-2097

rubygem-actionpack: directory traversal in Action View, incomplete CVE-2016-0752 fix

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.

CVSS 3.0 · 5.3 Medium EPSS 4.4% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Rhel Software Collections Rails Ruby On Rails
CVE-2016-2047

mysql: ssl-validate-cert incorrect hostname check

The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier; and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "/CN=" string in a field in a certificate, as demonstrated by "/OU=/CN=bar.com/CN=foo.com."

CVSS 3.0 · 5.9 Medium EPSS 3.7% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 5 more
CVE-2015-2648

mysql: unspecified vulnerability related to Server:DML (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 11 more
CVE-2014-3668

php: xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime()

Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a crafted first argument to the xmlrpc_set_type function or (2) a crafted argument to the xmlrpc_decode function, related to an out-of-bounds read operation.

CVSS 2.0 · 5.0 Medium EPSS 27.0% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Software Collections
CVE-2014-0118

httpd: mod_deflate denial of service

The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.

CVSS 2.0 · 4.3 Medium EPSS 37.3% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Http Server Debian Linux Enterprise Linux and 3 more
CVE-2016-1903

php: Out-of-bounds memory read via gdImageRotateInterpolated

The gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a large bgd_color argument to the imagerotate function.

CVSS 3.0 · 9.1 Critical EPSS 7.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-1669

V8: integer overflow leading to buffer overflow in Zone::New

The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.

CVSS 3.1 · 8.8 High EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 8 more
CVE-2015-2643

mysql: unspecified vulnerability related to Server:Optimizer (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 11 more
CVE-2016-1546

httpd: mod_http2 denial-of-service by thread starvation

The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (stream-processing outage) via modified flow-control windows.

CVSS 3.0 · 5.9 Medium EPSS 15.9% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Rhel Software Collections
CVE-2016-1283

pcre: heap buffer overflow in handling of duplicate named groups (8.39/14)

The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 7.8% KEV · Not listed
Vendors
Fedoraproject Oracle Pcre and 2 more
Products
Fedora Solaris Pcre and 2 more
CVE-2015-2641

mysql: unspecified vulnerability related to Server:Security:Privileges (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.

CVSS 2.0 · 3.5 Low EPSS 2.6% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Mysql Rhel Software Collections
CVE-2014-3597

php: multiple buffer over-reads in php_parserr

Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049.

CVSS 2.0 · 6.8 Medium EPSS 15.4% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Software Collections
CVE-2015-2639

mysql: unspecified vulnerability related to Server:Security:Firewall (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Firewall.

CVSS 2.0 · 3.5 Low EPSS 2.4% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Mysql Rhel Software Collections
CVE-2014-3587

file: incomplete fix for CVE-2012-1571 in cdf_read_property_info

Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.

CVSS 2.0 · 4.3 Medium EPSS 20.2% KEV · Not listed
Vendors
Christos Zoulas Php Redhat
Products
File Php Enterprise Linux and 1 more
CVE-2015-2620

mysql: unspecified vulnerability related to Server:Security:Privileges (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges.

CVSS 2.0 · 4.3 Medium EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Juniper and 3 more
Products
Ubuntu Linux Debian Linux Junos Space and 5 more
CVE-2014-0117

httpd: mod_proxy denial of service

The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.

CVSS 2.0 · 4.3 Medium EPSS 35.7% KEV · Not listed
Vendors
Apache Apple Redhat
Products
Http Server Mac Os X Enterprise Linux and 1 more
CVE-2015-2617

mysql: unspecified vulnerability related to Server:Partition (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Partition.

CVSS 2.0 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Mysql Rhel Software Collections