Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,219

Export CSV
CVE-2015-2582

mysql: unspecified vulnerability related to Server:GIS (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to GIS.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 10 more
CVE-2015-2573

mysql: unspecified vulnerability related to Server:DDL (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

CVSS 2.0 · 4.0 Medium EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 14 more
CVE-2015-2571

mysql: unspecified vulnerability related to Server:Optimizer (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 5.3% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 13 more
CVE-2015-2568

mysql: unspecified vulnerability related to Server:Security:Privileges (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges.

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 15 more
CVE-2015-2348

php: move_uploaded_file() NUL byte injection in file name

The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 5.0 Medium EPSS 8.3% KEV · Not listed
Vendors
Apple Opensuse Php and 1 more
Products
Mac Os X Opensuse Php and 8 more
CVE-2015-2301

php: use after free in phar_object.c

Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.

CVSS 2.0 · 7.5 High EPSS 14.7% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Mac Os X Ubuntu Linux Debian Linux and 10 more
CVE-2015-1863

wpa_supplicant: P2P SSID processing vulnerability

Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.

CVSS 2.0 · 5.8 Medium EPSS 5.2% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Opensuse and 8 more
CVE-2015-1779

qemu: vnc: insufficient resource limiting in VNC websockets decoder

The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.

CVSS 3.1 · 8.6 High EPSS 6.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2015-1774

libreoffice: HWP file filter vulnerability

The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write.

CVSS 2.0 · 6.8 Medium EPSS 7.6% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Openoffice Ubuntu Linux Debian Linux and 6 more
CVE-2015-1288

chromium-browser: Spell checking dictionaries fetched over HTTP in unspecified

The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263.

CVSS 2.0 · 6.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 5 more
CVE-2015-1287

chromium-browser: SOP bypass with CSS in unspecified

Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to core/fetch/CSSStyleSheetResource.cpp.

CVSS 2.0 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 5 more
CVE-2015-1286

chromium-browser: UXSS in blink.

Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)."

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 5 more
CVE-2015-1285

chromium-browser: Information leak in XSS auditor.

The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 44.0.2403.89, does not properly choose a truncation point, which makes it easier for remote attackers to obtain sensitive information via an unspecified linear-time attack.

CVSS 2.0 · 5.0 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 5 more
CVE-2016-4123

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2015-1284

chromium-browser: Use-after-free in blink.

The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly check for a page's maximum number of frames, which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements.

CVSS 2.0 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Google Opensuse Redhat
Products
Chrome Opensuse Enterprise Linux Desktop Supplementary and 3 more
CVE-2015-1282

chromium-browser: Use-after-free in pdfium.

Multiple use-after-free vulnerabilities in fpdfsdk/src/javascript/Document.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to the (1) Document::delay and (2) Document::DoFieldDelay functions.

CVSS 2.0 · 6.8 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 5 more
CVE-2015-1281

chromium-browser: CSP bypass in unspecified component

core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source.

CVSS 2.0 · 4.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 5 more
CVE-2015-1280

chromium-browser: Memory corruption in skia

SkPictureShader.cpp in Skia, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging access to a renderer process and providing crafted serialized data.

CVSS 2.0 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 5 more
CVE-2015-1279

chromium-browser: Heap-buffer-overflow in pdfium.

Integer overflow in the CJBig2_Image::expand function in fxcodec/jbig2/JBig2_Image.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via large height and stride values.

CVSS 2.0 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 5 more
CVE-2015-1289

chromium-browser: Various fixes from internal audits, fuzzing and other initiatives

Multiple unspecified vulnerabilities in Google Chrome before 44.0.2403.89 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 5 more