Export limit exceeded: 425865 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425865 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,194

Export CSV
CVE-2016-2510

bsh2: remote code execution via deserialization

BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

CVSS 3.1 · 8.1 High EPSS 70.4% KEV · Not listed
Vendors
Beanshell Canonical Debian and 1 more
Products
Beanshell Ubuntu Linux Debian Linux and 5 more
CVE-2014-2568

kernel: net: potential information leak when ubuf backed skbs are skb_zerocopy()ied

Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced.

CVSS 2.0 · 2.9 Low EPSS 1.0% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux
CVE-2014-2523

kernel: netfilter: nf_conntrack_dccp: incorrect skb_header_pointer API usages

net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function.

CVSS 2.0 · 10.0 Critical EPSS 10.4% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 3 more
CVE-2016-2774

dhcp: unclosed TCP connections to OMAPI or failover ports can cause DoS

ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions.

CVSS 3.1 · 5.9 Medium EPSS 73.6% KEV · Not listed
Vendors
Canonical Debian Isc and 1 more
Products
Ubuntu Linux Debian Linux Dhcp and 1 more
CVE-2014-2497

gd: NULL pointer dereference in gdImageCreateFromXpm()

The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.

CVSS 2.0 · 4.3 Medium EPSS 20.3% KEV · Not listed
Vendors
Canonical Debian Oracle and 3 more
Products
Ubuntu Linux Debian Linux Solaris and 11 more
CVE-2014-2427

OpenJDK: remove insecure Java Sound provider caching (Sound, 8026163)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Oracle and 1 more
Products
Ubuntu Linux Debian Linux Jdk and 5 more
CVE-2014-2423

OpenJDK: incorrect caching of data initialized via TCCL (JAXWS, 8026188)

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-0458.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Oracle and 1 more
Products
Ubuntu Linux Debian Linux Jdk and 5 more
CVE-2014-2421

OpenJDK: JPEG decoder input stream handling (2D, 8029854)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 6.8% KEV · Not listed
Vendors
Canonical Debian Ibm and 4 more
Products
Ubuntu Linux Debian Linux Forms Viewer and 9 more
CVE-2016-2825

Mozilla: Partial same-origin-policy through setting location.host through data: URI (MFSA 2016-54)

Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid data: URL.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Mozilla Opensuse
Products
Ubuntu Linux Firefox Leap and 1 more
CVE-2014-2414

OpenJDK: incorrect caching of data initialized via TCCL (JAXB, 8025030)

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXB.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Oracle and 1 more
Products
Ubuntu Linux Debian Linux Jdk and 5 more
CVE-2014-2413

OpenJDK: method handle call hierachy bypass (Libraries, 8032686)

Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect integrity via unknown vectors related to Libraries.

CVSS 2.0 · 4.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Jdk Jre and 3 more
CVE-2016-2381

perl: ambiguous environment variables handling

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVSS 3.1 · 7.5 High EPSS 9.1% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Opensuse and 7 more
CVE-2014-2412

OpenJDK: AWT thread context handling (AWT, 8025010)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, SE 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT, a different vulnerability than CVE-2014-0451.

CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Oracle and 1 more
Products
Ubuntu Linux Debian Linux Jdk and 5 more
CVE-2014-2405

OpenJDK: libpng unhandled zero-length PLTE chunk or NULL palette (AWT, 8031352)

Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-0462.

CVSS 2.0 · 10.0 Critical EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Oracle
Products
Ubuntu Linux Debian Linux Openjdk
CVE-2016-2383

kernel: incorrect branch fixups for eBPG allow arbitrary read

The adjust_branches function in kernel/bpf/verifier.c in the Linux kernel before 4.5 does not consider the delta in the backward-jump case, which allows local users to obtain sensitive information from kernel memory by creating a packet filter and then loading crafted BPF instructions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Opensuse
Products
Ubuntu Linux Linux Kernel Leap
CVE-2014-2403

OpenJDK: JAXP CharInfo file access restriction (JAXP, 8029282)

Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality via vectors related to JAXP.

CVSS 2.0 · 5.0 Medium EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Oracle and 1 more
Products
Ubuntu Linux Debian Linux Jdk and 4 more
CVE-2014-2402

OpenJDK: Incorrect NIO channel separation (Libraries, 8026716)

Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-0432 and CVE-2014-0455.

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Jdk Jre and 3 more
CVE-2014-2398

OpenJDK: insufficient escaping of window title string (Javadoc, 8026736)

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and JRockit R27.8.1 and R28.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Javadoc.

CVSS 2.0 · 3.5 Low EPSS 2.6% KEV · Not listed
Vendors
Canonical Debian Ibm and 3 more
Products
Ubuntu Linux Debian Linux Forms Viewer and 9 more
CVE-2014-2397

OpenJDK: classfile parser invalid BootstrapMethods attribute length (Hotspot, 8034926)

Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS 2.0 · 9.3 Critical EPSS 5.5% KEV · Not listed
Vendors
Canonical Debian Oracle and 1 more
Products
Ubuntu Linux Debian Linux Jdk and 4 more
CVE-2016-2391

Qemu: usb: multiple eof_timers in ohci module leads to null pointer dereference

The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu