Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,935

Export CSV
CVE-2012-6662

jquery-ui: XSS vulnerability in default content in Tooltip widget

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

CVSS 2.0 · 4.3 Medium EPSS 7.5% KEV · Not listed
Vendors
Jqueryui Redhat
Products
Jquery Ui Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2016-4302

libarchive: Heap buffer overflow in the Rar decompression functionality

Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.

CVSS 3.0 · 7.8 High EPSS 4.8% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2014-7923

ICU: regexp engine missing look-behind expression range check

The Regular Expressions package in International Components for Unicode (ICU) 52 before SVN revision 292944, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a look-behind expression.

CVSS 2.0 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Google Icu-project and 3 more
Products
Ubuntu Linux Chrome International Components For Unicode and 7 more
CVE-2016-4300

libarchive: Heap buffer overflow vulnerability in the 7zip read_SubStreamsInfo

Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.

CVSS 3.0 · 7.8 High EPSS 4.9% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2016-4286

flash-plugin: multiple code execution issues fixed in APSB16-32

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to bypass intended access restrictions via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 5.6% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 9 more
CVE-2016-4156

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Macos and 14 more
CVE-2016-4155

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2014-7840

qemu: insufficient parameter validation during ram load

The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2016-4448

libxml2: Format string vulnerability

Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

CVSS 3.1 · 9.8 Critical EPSS 7.0% KEV · Not listed
Vendors
Apple Hp Mcafee and 6 more
Products
Icloud Iphone Os Itunes and 19 more
CVE-2016-4154

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2016-4153

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2016-4578

kernel: Information leak in events in timer.c

sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.

CVSS 3.0 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 10 more
CVE-2016-4809

libarchive: Memory allocate error with symbolic links in cpio archives

The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.

CVSS 3.0 · 7.5 High EPSS 4.8% KEV · Not listed
Vendors
Libarchive Oracle Redhat
Products
Libarchive Linux Enterprise Linux and 7 more
CVE-2014-7815

qemu: vnc: insufficient bits_per_pixel from the client sanitization

The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.

CVSS 2.0 · 5.0 Medium EPSS 3.7% KEV · Not listed
Vendors
Canonical Debian Qemu and 2 more
Products
Ubuntu Linux Debian Linux Qemu and 9 more
CVE-2016-4152

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2016-4151

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2014-7300

gnome-shell: lockscreen bypass with printscreen key

GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Gnome-shell Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2016-4150

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.9% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2016-4149

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2016-4148

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Macos and 14 more