Export limit exceeded: 425877 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 36,461

Export CSV
CVE-2023-34969

dbus: dbus-daemon: assertion failure when a monitor is active and a message from the driver cannot be delivered

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Freedesktop and 1 more
Products
Debian Linux Fedora Dbus and 2 more
CVE-2023-26604

systemd: privilege escalation via the less pager

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Debian Redhat Systemd Project
Products
Debian Linux Enterprise Linux Rhel Els and 2 more
CVE-2023-4807

POLY1305 MAC implementation corrupts XMM registers on Windows

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.

CVSS 3.1 · 7.8 High EPSS 1.6% KEV · Not listed
Vendors
Openssl
Products
Openssl
CVE-2015-4911

OpenJDK: incomplete supportDTD enforcement (JAXP, 8130078)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893.

CVSS 2.0 · 5.0 Medium EPSS 3.9% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Jrockit and 2 more
CVE-2015-4903

OpenJDK: insufficient proxy class checks in RemoteObjectInvocationHandler (RMI, 8076339)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-4893

OpenJDK: incomplete MaxXMLNameLimit enforcement (JAXP, 8086733)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911.

CVSS 2.0 · 5.0 Medium EPSS 4.6% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Jrockit and 4 more
CVE-2015-4883

OpenJDK: incorrect access control context used in DGCClient (RMI, 8076413)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4860.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-4882

OpenJDK: incorrect String object deserialization in IIOPInputStream (CORBA, 8076387)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA.

CVSS 2.0 · 5.0 Medium EPSS 3.9% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-4881

OpenJDK: missing type checks in IIOPInputStream (CORBA, 8076392)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4835.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 1 more
CVE-2015-4872

OpenJDK: incomplete constraints enforcement by AlgorithmChecker (Security, 8131291)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect integrity via unknown vectors related to Security.

CVSS 2.0 · 5.0 Medium EPSS 3.2% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Jrockit and 4 more
CVE-2015-4860

OpenJDK: incorrect access control context used in DGCImpl (RMI, 8080688)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-4844

ICU: missing boundary checks in layout engine (OpenJDK 2D, 8132042)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

CVSS 2.0 · 10.0 Critical EPSS 7.5% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-4843

OpenJDK: java.nio Buffers integer overflow issues (Libraries, 8130891)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

CVSS 2.0 · 10.0 Critical EPSS 8.9% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-4842

OpenJDK: leak of user.dir location (JAXP, 8078427)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP.

CVSS 2.0 · 5.0 Medium EPSS 4.1% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-4840

OpenJDK: OOB access in CMS code (2D, 8086092)

Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-4835

OpenJDK: insufficient permission checks in StubGenerator (CORBA, 8076383)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881.

CVSS 2.0 · 10.0 Critical EPSS 6.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-4806

OpenJDK: HttpURLConnection header restriction bypass (Libraries, 8130193)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

CVSS 2.0 · 6.4 Medium EPSS 3.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-4805

OpenJDK: missing checks for proper initialization in ObjectStreamClass (Serialization, 8103671)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serialization.

CVSS 2.0 · 10.0 Critical EPSS 5.6% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Enterprise Linux and 3 more
CVE-2015-4803

OpenJDK: inefficient use of hash tables and lists during XML parsing (JAXP, 8068842)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4893 and CVE-2015-4911.

CVSS 2.0 · 5.0 Medium EPSS 4.6% KEV · Not listed
Vendors
Oracle Redhat
Products
Jdk Jre Jrockit and 4 more