Export limit exceeded: 425871 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,046

Export CSV
CVE-2015-1254

chromium-browser: Cross-origin bypass in Editing.

core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.

CVSS 2.0 · 5.0 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1255

chromium-browser: Use-after-free in WebAudio.

Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track.

CVSS 2.0 · 6.8 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-0413

JDK: unspecified vulnerability fixed in 7u75 and 8u31 (Serviceability)

Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Oracle Redhat and 1 more
Products
Ubuntu Linux Jdk Jre and 2 more
CVE-2015-1257

chromium-browser: Container-overflow in SVG.

platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document.

CVSS 2.0 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1258

chromium-browser: Negative-size parameter in Libvpx.

Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data.

CVSS 2.0 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1259

chromium-browser: Uninitialized value in PDFium.

PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1261

chromium-browser: URL bar spoofing in unspecified component

android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.

CVSS 2.0 · 5.0 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1262

chromium-browser: Uninitialized value in Blink.

platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text.

CVSS 2.0 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1263

chromium-browser: insecure download of spellcheck dictionary in unspecified component

The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-6770

chromium-browser: Cross-origin bypass in DOM

The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6768.

CVSS 2.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2015-1265

chromium-browser: Various fixes from internal audits, fuzzing and other initiatives.

Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 7.9% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Rhel Extras
CVE-2015-1266

chromium-browser: Scheme validation error in WebUI

content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.

CVSS 2.0 · 5.0 Medium EPSS 1.4% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2015-1267

chromium-browser: Cross-origin bypass in Blink

Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation of a DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that uses a Blink public API, related to WebArrayBufferConverter.cpp, WebBlob.cpp, WebDOMError.cpp, and WebDOMFileSystem.cpp.

CVSS 2.0 · 5.0 Medium EPSS 1.4% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2015-0410

OpenJDK: DER decoder infinite loop (Security, 8059485)

Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security.

CVSS 2.0 · 5.0 Medium EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Novell and 3 more
Products
Ubuntu Linux Debian Linux Suse Linux Enterprise Desktop and 9 more
CVE-2015-1269

chromium-browser: Normalization error in HSTS/HPKP preload list

The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string that (1) ends in a . (dot) character or (2) is not entirely lowercase.

CVSS 2.0 · 4.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2015-1270

ICU: Uninitialized memory read fixed in Chrome 44.0.2403.89

The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU), as used in Google Chrome before 44.0.2403.89, mishandles converter names with initial x- substrings, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file.

CVSS 2.0 · 6.8 Medium EPSS 2.7% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Chrome Opensuse and 6 more
CVE-2015-1271

chromium-browser: Heap-buffer-overflow in pdfium

PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.

CVSS 2.0 · 6.8 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 5 more
CVE-2015-6771

chromium-browser: Out of bounds access in v8

js/array.js in Google V8, as used in Google Chrome before 47.0.2526.73, improperly implements certain map and filter operations for arrays, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.

CVSS 2.0 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras