Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,046

Export CSV
CVE-2015-1233

chromium-browser: combination of V8, Gamepad and IPC bugs that can lead to remote code execution

Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 7.5 High EPSS 5.3% KEV · Not listed
Vendors
Apple Google Linux and 2 more
Products
Macos Chrome Linux Kernel and 2 more
CVE-2015-1234

chromium-browser: buffer overflow via race condition in GPU

Race condition in gpu/command_buffer/service/gles2_cmd_decoder.cc in Google Chrome before 41.0.2272.118 allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact by manipulating OpenGL ES commands.

CVSS 2.0 · 6.8 Medium EPSS 1.5% KEV · Not listed
Vendors
Apple Google Linux and 2 more
Products
Macos Chrome Linux Kernel and 2 more
CVE-2015-1235

chromium-browser: Cross-origin-bypass in HTML parser

The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element.

CVSS 2.0 · 5.0 Medium EPSS 1.6% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-1236

chromium-browser: Cross-origin-bypass in Blink

The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site containing a media element.

CVSS 2.0 · 4.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-1237

chromium-browser: Use-after-free in IPC

Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation.

CVSS 2.0 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-1238

chromium-browser: Out-of-bounds write in Skia

Skia, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-6758

chromium-browser: Bad-cast in PDFium

The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.

CVSS 2.0 · 6.8 Medium EPSS 1.4% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2015-6764

v8: unspecified out-of-bounds access vulnerability

The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.

CVSS 3.1 · 9.8 Critical EPSS 5.7% KEV · Not listed
Vendors
Debian Google Nodejs and 1 more
Products
Debian Linux Chrome Node.js and 1 more
CVE-2015-0413

JDK: unspecified vulnerability fixed in 7u75 and 8u31 (Serviceability)

Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Oracle Redhat and 1 more
Products
Ubuntu Linux Jdk Jre and 2 more
CVE-2015-1242

chromium-browser: Type confusion in V8

The ReduceTransitionElementsKind function in hydrogen-check-elimination.cc in Google V8 before 4.2.77.8, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that leverages "type confusion" in the check-elimination optimization.

CVSS 2.0 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 2 more
CVE-2015-1244

chromium-browser: HSTS bypass in WebSockets

The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.

CVSS 2.0 · 5.0 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-1245

chromium-browser: Use-after-free in PDFium

Use-after-free vulnerability in the OpenPDFInReaderView::Update function in browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allow user-assisted remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering interaction with a PDFium "Open PDF in Reader" button that has an invalid tab association.

CVSS 2.0 · 6.8 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1246

chromium-browser: Out-of-bounds read in Blink

Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-6676

flash-plugin: multiple code execution issues fixed in APSB15-23

Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6678.

CVSS 2.0 · 10.0 Critical EPSS 5.9% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 6 more
CVE-2015-1249

chromium-browser: Various fixes from internal audits, fuzzing and other initiatives

Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Chrome and 1 more
CVE-2015-0410

OpenJDK: DER decoder infinite loop (Security, 8059485)

Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security.

CVSS 2.0 · 5.0 Medium EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Novell and 3 more
Products
Ubuntu Linux Debian Linux Suse Linux Enterprise Desktop and 9 more
CVE-2015-1251

chromium-browser: Use-after-free in Speech.

Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document.

CVSS 2.0 · 6.8 Medium EPSS 2.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-6677

flash-plugin: multiple code execution issues fixed in APSB15-23

Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, and CVE-2015-5588.

CVSS 2.0 · 10.0 Critical EPSS 4.7% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Air Air Sdk Air Sdk \& Compiler and 6 more