Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,219

Export CSV
CVE-2016-4578

kernel: Information leak in events in timer.c

sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.

CVSS 3.0 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 10 more
CVE-2014-7815

qemu: vnc: insufficient bits_per_pixel from the client sanitization

The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.

CVSS 2.0 · 5.0 Medium EPSS 3.7% KEV · Not listed
Vendors
Canonical Debian Qemu and 2 more
Products
Ubuntu Linux Debian Linux Qemu and 9 more
CVE-2016-4470

kernel: Uninitialized variable in request_key handling causes kernel crash in error handling path

The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Novell Oracle and 1 more
Products
Linux Kernel Suse Linux Enterprise Real Time Extension Linux and 14 more
CVE-2014-7300

gnome-shell: lockscreen bypass with printscreen key

GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Gnome-shell Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2016-4448

libxml2: Format string vulnerability

Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

CVSS 3.1 · 9.8 Critical EPSS 7.0% KEV · Not listed
Vendors
Apple Hp Mcafee and 6 more
Products
Icloud Iphone Os Itunes and 19 more
CVE-2012-6662

jquery-ui: XSS vulnerability in default content in Tooltip widget

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

CVSS 2.0 · 4.3 Medium EPSS 7.5% KEV · Not listed
Vendors
Jqueryui Redhat
Products
Jquery Ui Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2014-7145

Kernel: cifs: NULL pointer dereference in SMB2_tcon

The SMB2_tcon function in fs/cifs/smb2pdu.c in the Linux kernel before 3.16.3 allows remote CIFS servers to cause a denial of service (NULL pointer dereference and client system crash) or possibly have unspecified other impact by deleting the IPC$ share during resolution of DFS referrals.

CVSS 2.0 · 7.8 High EPSS 3.7% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 4 more
CVE-2016-4302

libarchive: Heap buffer overflow in the Rar decompression functionality

Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.

CVSS 3.0 · 7.8 High EPSS 4.8% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2016-4300

libarchive: Heap buffer overflow vulnerability in the 7zip read_SubStreamsInfo

Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large number of substreams, which triggers a heap-based buffer overflow.

CVSS 3.0 · 7.8 High EPSS 4.9% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2014-6568

mysql: unspecified vulnerability related to Server:InnoDB:DML (CPU Jan 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DML.

CVSS 2.0 · 3.5 Low EPSS 7.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 16 more
CVE-2016-4286

flash-plugin: multiple code execution issues fixed in APSB16-32

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to bypass intended access restrictions via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 5.6% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 9 more
CVE-2016-4156

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Macos and 14 more
CVE-2016-4155

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2016-4154

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2014-6055

libvncserver: server stacked-based buffer overflow flaws in file transfer handling

Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message.

CVSS 2.0 · 6.5 Medium EPSS 7.8% KEV · Not listed
Vendors
Debian Fedoraproject Libvncserver and 1 more
Products
Debian Linux Fedora Libvncserver and 4 more
CVE-2016-4153

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2016-4152

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2014-6051

libvncserver: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling

Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 8.3% KEV · Not listed
Vendors
Debian Fedoraproject Libvncserver and 2 more
Products
Debian Linux Fedora Libvncserver and 5 more
CVE-2016-4151

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.8% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more
CVE-2016-4150

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CVSS 3.1 · 8.8 High EPSS 4.9% KEV · Not listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 12 more