Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 900

Export CSV
CVE-2015-5122

flash-plugin: two code execution issues in APSA15-04 / APSB15-18

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

CVSS 3.1 · 7.8 High EPSS 87.0% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Flash Player Desktop Runtime Macos and 12 more
CVE-2015-5123

flash-plugin: two code execution issues in APSA15-04 / APSB15-18

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

CVSS 3.1 · 7.8 High EPSS 18.8% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Flash Player Desktop Runtime Macos and 10 more
CVE-2016-4117

flash-plugin: multiple code execution issues fixed in APSB16-15

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

CVSS 3.1 · 7.8 High EPSS 94.3% KEV · Listed
Vendors
Adobe Opensuse Redhat and 1 more
Products
Flash Player Evergreen Opensuse and 7 more
CVE-2016-4171

flash-plugin: multiple code execution issues fixed in APSB16-18

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

CVSS 3.1 · 7.8 High EPSS 20.1% KEV · Listed
Vendors
Adobe Apple Google and 5 more
Products
Flash Player Mac Os X Macos and 12 more
CVE-2013-0640

acroread: Multiple unspecified vulnerabilities allow remote attackers to execute arbitrary code (APSB13-07)

Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.

CVSS 3.1 · 7.8 High EPSS 86.9% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Acrobat Acrobat Reader Mac Os X and 10 more
CVE-2013-0641

acroread: Multiple unspecified vulnerabilities allow remote attackers to execute arbitrary code (APSB13-07)

Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.

CVSS 3.1 · 7.8 High EPSS 32.3% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Acrobat Acrobat Reader Mac Os X and 10 more
CVE-2013-0643

flash-plugin: Firefox sandbox permissions issue (APSB13-08)

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

CVSS 3.1 · 8.8 High EPSS 10.5% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Mac Os X Linux Kernel and 9 more
CVE-2013-0648

flash-plugin: multiple code execution flaws (APSB13-08)

Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.

CVSS 3.1 · 8.8 High EPSS 11.1% KEV · Listed
Vendors
Adobe Apple Linux and 4 more
Products
Flash Player Mac Os X Linux Kernel and 9 more
CVE-2011-0609

flash-plugin: crash and potential arbitrary code execution (APSB11-05)

Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.

CVSS 3.1 · 7.8 High EPSS 63.5% KEV · Listed
Vendors
Adobe Apple Google and 6 more
Products
Acrobat Acrobat Reader Air and 12 more
CVE-2011-0611

flash-plugin: crash and potential arbitrary code execution (APSB11-07)

Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.

CVSS 3.1 · 8.8 High EPSS 99.4% KEV · Listed
Vendors
Adobe Apple Google and 6 more
Products
Acrobat Acrobat Reader Adobe Air and 13 more
CVE-2012-1823

php: command line arguments injection when run in CGI mode (VU#520827)

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

CVSS 3.1 · 9.8 Critical EPSS 100.0% KEV · Listed
Vendors
Apple Debian Fedoraproject and 5 more
Products
Mac Os X Debian Linux Fedora and 17 more
CVE-2012-2034

flash-plugin: multiple code execution flaws (APSB12-14)

Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037.

CVSS 3.1 · 7.5 High EPSS 7.7% KEV · Listed
Vendors
Adobe Apple Google and 5 more
Products
Air Flash Player Macos and 11 more
CVE-2014-0196

kernel: pty layer race condition leading to memory corruption

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.

CVSS 3.1 · 5.5 Medium EPSS 20.3% KEV · Listed
Vendors
Canonical Debian F5 and 4 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 30 more
CVE-2012-5076

OpenJDK: com.sun.org.glassfish.* not restricted packages (JAX-WS, 7163198)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.

CVSS 3.1 · 9.8 Critical EPSS 91.2% KEV · Listed
Vendors
Oracle Redhat Suse
Products
Jre Enterprise Linux Rhel Extras and 1 more
CVE-2015-2590

OpenJDK: deserialization issue in ObjectInputStream.readSerialData() (Libraries, 8076401)

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

CVSS 3.1 · 9.8 Critical EPSS 25.5% KEV · Listed
Vendors
Canonical Debian Opensuse and 3 more
Products
Ubuntu Linux Debian Linux Opensuse and 22 more
CVE-2014-3153

kernel: futex: pi futexes requeue issue

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

CVSS 3.1 · 7.8 High EPSS 37.2% KEV · Listed
Vendors
Canonical Linux Opensuse and 3 more
Products
Ubuntu Linux Linux Kernel Opensuse and 10 more
CVE-2010-3904

kernel: RDS sockets local privilege escalation

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

CVSS 3.1 · 7.8 High EPSS 15.9% KEV · Listed
Vendors
Canonical Linux Opensuse and 3 more
Products
Ubuntu Linux Linux Kernel Opensuse and 5 more
CVE-2026-25702

nftables disabled due to incorrect kernel backport

A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules applied via nftables to not be effective.This issue affects SUSE Linux Enterprise Server: from 9e6d9d4601768c75fdb0bad3fbbe636e748939c2 before 9c294edb7085fb91650bc12233495a8974c5ff2d.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Suse
Products
Linux Enterprise Server Suse Linux Enterprise Server
CVE-2004-1070

security flaw

The load_elf_binary function in the binfmt_elf loader (binfmt_elf.c) in Linux kernel 2.4.x up to 2.4.27, and 2.6.x up to 2.6.8, does not properly check return values from calls to the kernel_read function, which may allow local users to modify sensitive memory in a setuid program and execute arbitrary code.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat Suse and 2 more
Products
Linux Kernel Enterprise Linux Enterprise Linux Desktop and 5 more