Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,351

Export CSV
CVE-2015-2620

mysql: unspecified vulnerability related to Server:Security:Privileges (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges.

CVSS 2.0 · 4.3 Medium EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Juniper and 3 more
Products
Ubuntu Linux Debian Linux Junos Space and 5 more
CVE-2016-5104

libimobiledevice: Sockets listening on INADDR_ANY

The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.

CVSS 3.0 · 5.3 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Libimobiledevice Opensuse
Products
Ubuntu Linux Libimobiledevice Libusbmuxd and 2 more
CVE-2015-2617

mysql: unspecified vulnerability related to Server:Partition (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Partition.

CVSS 2.0 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Mysql Rhel Software Collections
CVE-2016-5107

Qemu: scsi: megasas: out-of-bounds read in megasas_lookup_frame() function

The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2015-2582

mysql: unspecified vulnerability related to Server:GIS (CPU July 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to GIS.

CVSS 2.0 · 4.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Mariadb and 2 more
Products
Ubuntu Linux Debian Linux Mariadb and 10 more
CVE-2015-2573

mysql: unspecified vulnerability related to Server:DDL (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.

CVSS 2.0 · 4.0 Medium EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 14 more
CVE-2016-5180

c-ares: Single byte out of buffer write

Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.

CVSS 3.1 · 9.8 Critical EPSS 8.7% KEV · Not listed
Vendors
C-ares C-ares Project Canonical and 3 more
Products
C-ares C-ares Ubuntu Linux and 3 more
CVE-2015-2571

mysql: unspecified vulnerability related to Server:Optimizer (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.

CVSS 2.0 · 4.0 Medium EPSS 5.3% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 13 more
CVE-2015-2568

mysql: unspecified vulnerability related to Server:Security:Privileges (CPU April 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges.

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed
Vendors
Canonical Debian Mariadb and 3 more
Products
Ubuntu Linux Debian Linux Mariadb and 15 more
CVE-2015-2317

Django: possible XSS attack via user-supplied redirect URLs

The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL.

CVSS 2.0 · 4.3 Medium EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 3 more
Products
Ubuntu Linux Debian Linux Django and 3 more
CVE-2016-5337

Qemu: scsi: megasas: information leakage in megasas_ctrl_get_info

The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2016-5338

Qemu: scsi: esp: OOB r/w access while processing ESP_FIFO

The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu
Products
Ubuntu Linux Debian Linux Qemu
CVE-2015-2316

Django: possible denial of service in strip_tags()

The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.

CVSS 2.0 · 5.0 Medium EPSS 4.8% KEV · Not listed
Vendors
Canonical Djangoproject Fedoraproject and 2 more
Products
Ubuntu Linux Django Fedora and 2 more
CVE-2016-5384

fontconfig: Possible double free due to insufficiently validated cache files

fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2016-5387

HTTPD: sets environmental variable based on user supplied Proxy request header

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.

CVSS 3.1 · 8.1 High EPSS 55.7% KEV · Not listed
Vendors
Apache Canonical Debian and 5 more
Products
Http Server Ubuntu Linux Debian Linux and 19 more
CVE-2016-5403

Qemu: virtio: unbounded memory allocation on host via guest leading to DoS

The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Linux and 12 more
CVE-2015-2305

regex: heap overflow in regcomp() on 32-bit architectures

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 8.9% KEV · Not listed
Vendors
Canonical Debian Opensuse and 3 more
Products
Ubuntu Linux Debian Linux Opensuse and 3 more