Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2015-0374

mysql: unspecified vulnerability related to Server:Security:Privileges:Foreign Key (CPU Jan 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges : Foreign Key.

CVSS 2.0 · 3.5 Low EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 16 more
CVE-2014-0226

httpd: mod_status heap-based buffer overflow

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.

CVSS 2.0 · 6.8 Medium EPSS 85.8% KEV · Not listed
Vendors
Apache Debian Oracle and 1 more
Products
Http Server Debian Linux Enterprise Manager Ops Center and 6 more
CVE-2015-8876

php: Zend/zend_exceptions.c does not validate certain Exception objects

Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.

CVSS 3.0 · 9.8 Critical EPSS 7.7% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2015-8874

gd: gdImageFillToBorder deep recursion leading to stack overflow

Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of service via a crafted imagefilltoborder call.

CVSS 3.0 · 7.5 High EPSS 8.6% KEV · Not listed
Vendors
Opensuse Php Redhat
Products
Leap Php Rhel Software Collections
CVE-2015-0273

php: use after free vulnerability in unserialize() with DateTimeZone

Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the php_date_initialize_from_hash function.

CVSS 2.0 · 7.5 High EPSS 42.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Software Collections
CVE-2014-2497

gd: NULL pointer dereference in gdImageCreateFromXpm()

The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.

CVSS 2.0 · 4.3 Medium EPSS 20.3% KEV · Not listed
Vendors
Canonical Debian Oracle and 3 more
Products
Ubuntu Linux Debian Linux Solaris and 11 more
CVE-2014-0062

postgresql: CREATE INDEX race condition possibly leading to privilege escalation

Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.

CVSS 2.0 · 4.9 Medium EPSS 3.0% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2015-8873

php: Stack consumption vulnerability in Zend/zend_exceptions.c

Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service (segmentation fault) via recursive method calls.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Opensuse Php Redhat
Products
Leap Php Rhel Software Collections
CVE-2015-8867

php: openssl_random_pseudo_bytes() is not cryptographically secure

The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.

CVSS 3.0 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Canonical Php Redhat
Products
Ubuntu Linux Php Rhel Software Collections
CVE-2015-0253

httpd: NULL pointer dereference crash with ErrorDocument 400 pointing to a local URL-path

The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI.

CVSS 2.0 · 5.0 Medium EPSS 12.8% KEV · Not listed
Vendors
Apache Apple Oracle and 1 more
Products
Http Server Mac Os X Mac Os X Server and 3 more
CVE-2015-8866

php: libxml_disable_entity_loader setting is shared between threads

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

CVSS 3.1 · 9.6 Critical EPSS 4.2% KEV · Not listed
Vendors
Canonical Opensuse Php and 2 more
Products
Ubuntu Linux Leap Opensuse and 4 more
CVE-2015-8865

file: Buffer over-write in finfo_open with malformed magic file

The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.

CVSS 3.0 · 7.3 High EPSS 5.5% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Rhel Software Collections
CVE-2014-2494

mysql: unspecified vulnerability related to ENARC (CPU July 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier allows remote authenticated users to affect availability via vectors related to ENARC.

CVSS 2.0 · 4.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Debian Mariadb Oracle and 2 more
Products
Debian Linux Mariadb Mysql and 7 more
CVE-2015-8835

php: type confusion issue in Soap Client call() method

The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which allows remote attackers to cause a denial of service (NULL pointer dereference, type confusion, and application crash) or possibly execute arbitrary code via crafted serialized data representing a numerically indexed _cookies array, related to the SoapClient::__call method in ext/soap/soap.c.

CVSS 3.0 · 9.8 Critical EPSS 6.2% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2015-8395

pcre: Buffer overflow caused by duplicate named references (8.38/36)

PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8392.

CVSS 2.0 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Pcre Redhat
Products
Perl Compatible Regular Expression Library Rhel Software Collections
CVE-2014-0061

postgresql: privilege escalation via procedural language validator functions

The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions.

CVSS 2.0 · 6.5 Medium EPSS 4.9% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2014-0060

postgresql: SET ROLE without ADMIN OPTION allows adding and removing group members

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.

CVSS 2.0 · 4.0 Medium EPSS 4.1% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Cloudforms Managementengine Enterprise Linux and 1 more
CVE-2015-8392

pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27)

PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.

CVSS 2.0 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Pcre Redhat
Products
Perl Compatible Regular Expression Library Rhel Software Collections
CVE-2015-8391

pcre: inefficient posix character class syntax check (8.38/16)

The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 6.4% KEV · Not listed
Vendors
Fedoraproject Oracle Pcre and 2 more
Products
Fedora Linux Pcre and 9 more
CVE-2014-2438

mysql: unspecified DoS related to Replication (CPU April 2014)

Unspecified vulnerability in Oracle MySQL Server 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Replication.

CVSS 2.0 · 3.5 Low EPSS 3.2% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 7 more