Export limit exceeded: 425863 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,030

Export CSV
CVE-2016-1678

chromium-browser: heap overflow in v8

objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 8 more
CVE-2016-1677

chromium-browser: type confusion in v8

uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type confusion."

CVSS 3.0 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 8 more
CVE-2016-1676

chromium-browser: cross-origin bypass in extension bindings

extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Chrome Leap and 6 more
CVE-2016-1675

chromium-browser: cross-origin bypass in blink

Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattachment during destruction, related to FrameLoader.cpp and LocalFrame.cpp.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 7 more
CVE-2016-1674

chromium-browser: cross-origin bypass in extensions

The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Chrome Leap and 6 more
CVE-2016-1673

chromium-browser: cross-origin bypass in blink

Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Chrome and 7 more
CVE-2016-1672

chromium-browser: cross-origin bypass in extension bindings

The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles properties, which allows remote attackers to conduct bindings-interception attacks and bypass the Same Origin Policy via unspecified vectors.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Chrome Leap and 6 more
CVE-2013-5704

httpd: bypass of mod_headers rules via chunked requests

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

CVSS 2.0 · 5.0 Medium EPSS 58.0% KEV · Not listed
Vendors
Apache Apple Canonical and 2 more
Products
Http Server Mac Os X Mac Os X Server and 14 more
CVE-2016-1665

chromium-browser: information leak in v8

The JSGenericLowering class in compiler/js-generic-lowering.cc in Google V8, as used in Google Chrome before 50.0.2661.94, mishandles comparison operators, which allows remote attackers to obtain sensitive information via crafted JavaScript code.

CVSS 3.0 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Google Opensuse Redhat
Products
Chrome Opensuse Enterprise Linux Desktop Supplementary and 4 more
CVE-2016-1664

chromium-browser: address bar spoofing

The HistoryController::UpdateForCommit function in content/renderer/history_controller.cc in Google Chrome before 50.0.2661.94 mishandles the interaction between subframe forward navigations and other forward navigations, which allows remote attackers to spoof the address bar via a crafted web site.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google Opensuse Redhat
Products
Chrome Opensuse Enterprise Linux Desktop Supplementary and 4 more
CVE-2016-1663

chromium-browser: use-after-free in blink's v8 bindings

The SerializedScriptValue::transferArrayBuffers function in WebKit/Source/bindings/core/v8/SerializedScriptValue.cpp in the V8 bindings in Blink, as used in Google Chrome before 50.0.2661.94, mishandles certain array-buffer data structures, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site.

CVSS 3.0 · 8.8 High EPSS 1.0% KEV · Not listed
Vendors
Google Opensuse Redhat
Products
Chrome Opensuse Enterprise Linux Desktop Supplementary and 4 more
CVE-2016-1662

chromium-browser: use-after-free in extensions

extensions/renderer/gc_callback.cc in Google Chrome before 50.0.2661.94 does not prevent fallback execution once the Garbage Collection callback has started, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.

CVSS 3.0 · 9.8 Critical EPSS 3.9% KEV · Not listed
Vendors
Google Opensuse Redhat
Products
Chrome Opensuse Enterprise Linux Desktop Supplementary and 4 more
CVE-2016-1661

chromium-browser: memory corruption in cross-process frames

Blink, as used in Google Chrome before 50.0.2661.94, does not ensure that frames satisfy a check for the same renderer process in addition to a Same Origin Policy check, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted web site, related to BindingSecurity.cpp and DOMWindow.cpp.

CVSS 3.0 · 8.0 High EPSS 1.2% KEV · Not listed
Vendors
Google Opensuse Redhat
Products
Chrome Opensuse Enterprise Linux Desktop Supplementary and 4 more
CVE-2016-1660

chromium-browser: out-of-bounds write in blink

Blink, as used in Google Chrome before 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::double_conversion::Vector classes, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted web site.

CVSS 3.0 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Google Opensuse Redhat
Products
Chrome Opensuse Enterprise Linux Desktop Supplementary and 4 more
CVE-2016-0749

spice: heap-based memory corruption within smartcard handling

The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.

CVSS 3.0 · 9.8 Critical EPSS 8.5% KEV · Not listed
Vendors
Debian Microsoft Opensuse and 2 more
Products
Debian Linux Windows Leap and 9 more
CVE-2016-0741

389-ds-base: worker threads do not detect abnormally closed connections causing DoS

slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and connection blocking) by leveraging an abnormally closed connection.

CVSS 3.0 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2016-0695

OpenJDK: insufficient DSA key parameters checks (Security, 8138593)

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security.

CVSS 3.0 · 5.9 Medium EPSS 3.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Jrockit and 11 more
CVE-2016-0651

mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU April 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Mariadb Opensuse Oracle and 2 more
Products
Mariadb Leap Opensuse and 14 more