Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2014-0437

mysql: unspecified vulnerability related to Optimizer DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVSS 2.0 · 3.5 Low EPSS 3.2% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2014-0420

mysql: unspecified vulnerability related to Replication DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.34 and earlier, and 5.6.14 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Replication.

CVSS 2.0 · 2.8 Low EPSS 3.7% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 7 more
CVE-2013-6712

php: heap-based buffer over-read in DateInterval

The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.

CVSS 2.0 · 5.0 Medium EPSS 4.6% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Mac Os X Ubuntu Linux Debian Linux and 4 more
CVE-2014-0412

mysql: unspecified vulnerability related to InnoDB DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

CVSS 2.0 · 4.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2014-0402

mysql: unspecified vulnerability related to Locking DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Locking.

CVSS 2.0 · 4.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2013-4491

rubygem-actionpack: i18n missing translation XSS

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Openstack Rhel Software Collections 1.4 and 2 more
CVE-2014-0401

mysql: unspecified DoS vulnerability (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.72 and earlier, 5.5.34 and earlier, and 5.6.14 and earlier allows remote authenticated users to affect availability via unknown vectors.

CVSS 2.0 · 4.0 Medium EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2014-0393

mysql: unspecified vulnerability related to InnoDB affecting integrity (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect integrity via unknown vectors related to InnoDB.

CVSS 2.0 · 3.3 Low EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2013-6650

v8: incorrect handling of popular pages

The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors that trigger incorrect handling of "popular pages."

CVSS 2.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 3 more
CVE-2013-6640

v8: DoS (out-of-bounds read) in DehoistArrayIndex function in hydrogen.cc

The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds read) via JavaScript code that sets a variable to the value of an array element with a crafted index.

CVSS 2.0 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Google Redhat
Products
Chrome V8 Rhel Software Collections and 2 more
CVE-2013-4450

NodeJS: HTTP Pipelining DoS

The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.

CVSS 2.0 · 5.0 Medium EPSS 37.2% KEV · Not listed
Vendors
Nodejs Redhat
Products
Nodejs Rhel Software Collections
CVE-2014-0386

mysql: unspecified vulnerability related to Optimizer DoS (CPU Jan 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.71 and earlier, 5.5.33 and earlier, and 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 9 more
CVE-2013-6639

v8: DoS (out-of-bounds write) in DehoistArrayIndex function in hydrogen.cc

The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via JavaScript code that sets the value of an array element with a crafted index.

CVSS 2.0 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Google Redhat
Products
Chrome V8 Rhel Software Collections and 2 more
CVE-2013-6420

php: memory corruption in openssl_x509_parse()

The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.

CVSS 2.0 · 7.5 High EPSS 35.4% KEV · Not listed
Vendors
Apple Opensuse Php and 1 more
Products
Mac Os X Opensuse Php and 5 more
CVE-2013-6417

rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

CVSS 2.0 · 6.4 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Cloudforms Managementengine Openstack Rhel Software Collections and 2 more
CVE-2013-4287

rubygems: version regex algorithmic complexity vulnerability

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

CVSS 2.0 · 4.3 Medium EPSS 3.3% KEV · Not listed
Vendors
Redhat Ruby-lang Rubygems
Products
Enterprise Linux Enterprise Mrg Openshift and 4 more
CVE-2012-5615

mysql: Remote Preauth User Enumeration flaw

Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates different error messages with different time delays depending on whether a user name exists, which allows remote attackers to enumerate valid usernames.

CVSS 2.0 · 5.0 Medium EPSS 14.8% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 2 more
CVE-2013-6415

rubygem-actionpack: number_to_currency XSS

Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.

CVSS 2.0 · 4.3 Medium EPSS 3.2% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Openstack Rhel Software Collections 1.4 and 2 more
CVE-2014-0082

rubygem-actionpack: Action View string handling denial of service

actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.

CVSS 2.0 · 5.0 Medium EPSS 6.2% KEV · Not listed
Vendors
Redhat Rubyonrails
Products
Cloudforms Managementengine Rhel Software Collections Rails and 1 more
CVE-2014-0081

rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability

Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.

CVSS 2.0 · 4.3 Medium EPSS 4.0% KEV · Not listed
Vendors
Opensuse Opensuse Project Redhat and 1 more
Products
Opensuse Opensuse Cloudforms and 5 more