Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,030

Export CSV
CVE-2016-3492

mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer.

CVSS 3.1 · 6.5 Medium EPSS 6.8% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 7 more
CVE-2016-4149

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2016-3069

mercurial: convert extension command injection via git repository names

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

CVSS 3.0 · 8.8 High EPSS 5.0% KEV · Not listed
Vendors
Debian Fedoraproject Mercurial and 3 more
Products
Debian Linux Fedora Mercurial and 12 more
CVE-2014-0384

mysql: unspecified DoS related to XML (CPU April 2014)

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.35 and earlier and 5.6.15 and earlier allows remote authenticated users to affect availability via vectors related to XML.

CVSS 2.0 · 4.0 Medium EPSS 3.3% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 7 more
CVE-2016-4153

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2016-2857

Qemu: net: out of bounds read in net_checksum_calculate()

The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 9 more
CVE-2016-2818

Mozilla: Miscellaneous memory safety hazards (rv:45.2) (MFSA 2016-49)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 3.0 · 8.8 High EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Mozilla and 3 more
Products
Ubuntu Linux Debian Linux Firefox and 19 more
CVE-2016-5425

tomcat: Local privilege escalation via systemd-tmpfiles service

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CVSS 3.1 · 7.8 High EPSS 3.8% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Tomcat Instantis Enterprisetrack Linux and 7 more
CVE-2016-4286

flash-plugin: multiple code execution issues fixed in APSB16-32

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to bypass intended access restrictions via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 5.6% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 9 more
CVE-2016-2775

bind: Too long query name causes segmentation fault in lwresd

ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.

CVSS 3.1 · 5.9 Medium EPSS 63.3% KEV · Not listed
Vendors
Fedoraproject Hp Isc and 1 more
Products
Fedora Hp-ux Bind and 8 more
CVE-2016-2150

spice: Host memory access from guest with invalid primary surface parameters

SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Debian Microsoft Opensuse and 2 more
Products
Debian Linux Windows Leap and 9 more
CVE-2016-5418

libarchive: Archive Entry with type 1 (hardlink), but has a non-zero data size file overwrite

The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.

CVSS 3.0 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Libarchive Oracle Redhat
Products
Libarchive Linux Enterprise Linux and 8 more
CVE-2016-2109

openssl: ASN.1 BIO handling of large amounts of data

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

CVSS 3.0 · 7.5 High EPSS 29.2% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Enterprise Linux Desktop and 9 more
CVE-2016-2108

openssl: Memory corruption in the ASN.1 encoder

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.

CVSS 3.0 · 9.8 Critical EPSS 77.9% KEV · Not listed
Vendors
Google Openssl Redhat
Products
Android Openssl Enterprise Linux and 10 more
CVE-2016-2107

openssl: Padding oracle in AES-NI CBC MAC check

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.

CVSS 3.1 · 5.9 Medium EPSS 89.1% KEV · Not listed
Vendors
Canonical Debian Google and 5 more
Products
Ubuntu Linux Debian Linux Android and 15 more
CVE-2014-0181

kernel: net: insufficient permision checks of netlink messages

The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Linux Opensuse Redhat and 1 more
Products
Linux Kernel Evergreen Enterprise Linux and 6 more
CVE-2016-2106

openssl: EVP_EncryptUpdate overflow

Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

CVSS 3.0 · 7.5 High EPSS 27.3% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Enterprise Linux Desktop and 10 more