Export limit exceeded: 26160 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425863 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,030

Export CSV
CVE-2016-5624

mysql: unspecified vulnerability in subcomponent: Server: DML (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows remote authenticated users to affect availability via vectors related to DML.

CVSS 3.1 · 6.5 Medium EPSS 5.1% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 7 more
CVE-2016-5629

mysql: unspecified vulnerability in subcomponent: Server: Federated (CPU October 2016)

Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Federated.

CVSS 3.1 · 4.9 Medium EPSS 3.3% KEV · Not listed
Vendors
Mariadb Oracle Redhat
Products
Mariadb Mysql Enterprise Linux and 7 more
CVE-2014-0101

kernel: net: sctp: null pointer dereference when processing authenticated cookie_echo chunk

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

CVSS 2.0 · 7.8 High EPSS 7.2% KEV · Not listed
Vendors
Canonical F5 Linux and 1 more
Products
Ubuntu Linux Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 27 more
CVE-2016-1833

libxml2: Heap-based buffer overread in htmlCurrentChar

The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.

CVSS 3.0 · 5.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Iphone Os Mac Os X Tvos and 13 more
CVE-2014-0069

kernel: cifs: incorrect handling of bogus user pointers during uncached writes

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat Suse
Products
Linux Kernel Enterprise Linux Enterprise Linux Desktop and 8 more
CVE-2016-1703

chromium-browser: various fixes from internal audits

Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.79 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 3.0 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 7 more
CVE-2016-1702

chromium-browser: out-of-bounds read in skia

The SkRegion::readFromMemory function in core/SkRegion.cpp in Skia, as used in Google Chrome before 51.0.2704.79, does not validate the interval count, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted serialized data.

CVSS 3.0 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 7 more
CVE-2016-1701

chromium-browser: use-after-free in autofill

The Autofill implementation in Google Chrome before 51.0.2704.79 mishandles the interaction between field updates and JavaScript code that triggers a frame deletion, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site, a different vulnerability than CVE-2016-1690.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Chrome Leap and 6 more
CVE-2016-1700

chromium-browser: use-after-free in extensions

extensions/renderer/runtime_custom_bindings.cc in Google Chrome before 51.0.2704.79 does not consider side effects during creation of an array of extension views, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to extensions.

CVSS 3.0 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Chrome Leap and 6 more
CVE-2016-1699

chromium-browser: parameter sanitization failure in devtools

WebKit/Source/devtools/front_end/devtools.js in the Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 51.0.2704.79, does not ensure that the remoteFrontendUrl parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted URL.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 7 more
CVE-2016-7859

flash-plugin: multiple code execution issues fixed in APSB16-37

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS 3.0 · 8.8 High EPSS 7.0% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player For Linux Mac Os X and 12 more
CVE-2016-7163

openjpeg: Integer overflow in opj_pi_create_decode

Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.

CVSS 3.1 · 7.8 High EPSS 7.1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 7 more
CVE-2016-7166

libarchive: Denial of service using a crafted gzip file

libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file.

CVSS 3.0 · 5.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Libarchive Oracle Redhat
Products
Libarchive Linux Enterprise Linux and 7 more
CVE-2016-1698

chromium-browser: information leak in extension bindings

The createCustomType function in extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.79 does not validate module types, which might allow attackers to load arbitrary modules or obtain sensitive information by leveraging a poisoned definition.

CVSS 3.0 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Chrome Leap and 6 more
CVE-2016-1697

chromium-browser: cross-origin bypass in blink

The FrameLoader::startLoad function in WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 51.0.2704.79, does not prevent frame navigations during DocumentLoader detach operations, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.

CVSS 3.0 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 7 more
CVE-2016-7796

systemd: freeze when PID 1 receives a zero-length message over notify socket

The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Novell Redhat Systemd Project
Products
Suse Linux Enterprise Desktop Suse Linux Enterprise Server Suse Linux Enterprise Server For Sap and 8 more
CVE-2016-1696

chromium-browser: cross-origin bypass in extension bindings

The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Chrome Leap and 6 more
CVE-2016-1695

chromium-browser: various fixes from internal audits

Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 3.0 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 7 more
CVE-2016-1694

chromium-browser: hpkp pins removed on cache clearance

browser/browsing_data/browsing_data_remover.cc in Google Chrome before 51.0.2704.63 deletes HPKP pins during cache clearing, which makes it easier for remote attackers to spoof web sites via a valid certificate from an arbitrary recognized Certification Authority.

CVSS 3.0 · 5.3 Medium EPSS 1.0% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Chrome Leap and 6 more