Export limit exceeded: 26253 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26,253

Export CSV
CVE-2017-5120

chromium-browser: potential https downgrade during redirect navigation

Inappropriate use of www mismatch redirects in browser navigation in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to potentially downgrade HTTPS requests to HTTP via a crafted HTML page. In other words, Chrome could transmit cleartext even though the user had entered an https URL, because of a misdesigned workaround for cases where the domain name in a URL almost matches the domain name in an X.509 server certificate (but differs in the initial "www." substring).

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Apple Debian Google and 3 more
Products
Macos Debian Linux Android and 7 more
CVE-2017-2992

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability when parsing an MP4 header. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 32.7% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 6 more
CVE-2017-2993

flash-plugin: multiple code execution issues fixed in APSB17-04

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability related to event handlers. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 6.0% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 6 more
CVE-2017-3058

flash-plugin: multiple code execution issues fixed in APSB17-10

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable use after free vulnerability in the sound class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.0 · 7.8 High EPSS 6.5% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Mac Os X Chrome Os and 5 more
CVE-2017-3059

flash-plugin: multiple code execution issues fixed in APSB17-10

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable use after free vulnerability in the internal script object. Successful exploitation could lead to arbitrary code execution.

CVSS 3.0 · 9.8 Critical EPSS 9.5% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Mac Os X Chrome Os and 5 more
CVE-2017-3060

flash-plugin: multiple code execution issues fixed in APSB17-10

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability in the ActionScript2 code parser. Successful exploitation could lead to arbitrary code execution.

CVSS 3.0 · 9.8 Critical EPSS 7.6% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Mac Os X Chrome Os and 5 more
CVE-2017-3068

flash-plugin: multiple code execution issues fixed in APSB17-15

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Advanced Video Coding engine. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 20.4% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 9 more
CVE-2017-3069

flash-plugin: multiple code execution issues fixed in APSB17-15

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BlendMode class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 5.0% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 9 more
CVE-2017-3070

flash-plugin: multiple code execution issues fixed in APSB17-15

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the ConvolutionFilter class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 5.0% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 9 more
CVE-2017-3071

flash-plugin: multiple code execution issues fixed in APSB17-15

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when masking display objects. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 6.2% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 9 more
CVE-2017-3072

flash-plugin: multiple code execution issues fixed in APSB17-15

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the BitmapData class. Successful exploitation could lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 5.0% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 9 more
CVE-2017-3085

flash-plugin: Information Disclosure via Security Bypass issue fixed in APSB17-23

Adobe Flash Player versions 26.0.0.137 and earlier have a security bypass vulnerability that leads to information disclosure when performing URL redirect.

CVSS 3.1 · 7.4 High EPSS 4.5% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Flash Player Desktop Runtime Mac Os X and 9 more
CVE-2017-3112

flash-plugin: multiple code execution issues fixed in APSB17-33

An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is part of AdobePSDK metadata. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.

CVSS 3.0 · 9.8 Critical EPSS 6.2% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Macos Chrome Os and 8 more
CVE-2017-3114

flash-plugin: multiple code execution issues fixed in APSB17-33

An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is part of providing language- and region- or country- specific functionality. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.

CVSS 3.0 · 9.8 Critical EPSS 6.2% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Macos Chrome Os and 8 more
CVE-2015-9004

kernel: Allows creating groups that can't be co-scheduled

kernel/events/core.c in the Linux kernel before 3.19 mishandles counter grouping, which allows local users to gain privileges via a crafted application, related to the perf_pmu_register and perf_event_open functions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google Linux
Products
Android Linux Kernel
CVE-2017-5045

chromium-browser: information disclosure in xss auditor

XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which allowed a remote attacker to brute force JavaScript variables via a crafted HTML page.

CVSS 3.1 · 6.1 Medium EPSS 1.5% KEV · Not listed
Vendors
Apple Debian Google and 3 more
Products
Macos Debian Linux Android and 7 more
CVE-2017-5046

chromium-browser: information disclosure in blink

V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure.

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Apple Debian Google and 3 more
Products
Macos Debian Linux Android and 7 more
CVE-2017-5047

chromium-browser: multiple out of bounds writes in chunkdemuxer

An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.

CVSS 3.0 · 8.8 High EPSS 1.0% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Android Chrome and 2 more
CVE-2017-5048

chromium-browser: multiple out of bounds writes in chunkdemuxer

An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.

CVSS 3.0 · 8.8 High EPSS 1.0% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Android Chrome and 2 more
CVE-2017-5049

chromium-browser: multiple out of bounds writes in chunkdemuxer

An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.

CVSS 3.0 · 8.8 High EPSS 1.0% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Android Chrome and 2 more