Export limit exceeded: 26203 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26,203

Export CSV
CVE-2014-8438

flash-plugin: multiple code execution flaws (APSB14-24)

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0573 and CVE-2014-0588.

CVSS 2.0 · 10.0 Critical EPSS 9.9% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2014-8440

flash-plugin: multiple code execution flaws (APSB14-24)

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-0581, and CVE-2014-8441.

CVSS 2.0 · 10.0 Critical EPSS 81.9% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2014-8441

flash-plugin: multiple code execution flaws (APSB14-24)

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0576, CVE-2014-0581, and CVE-2014-8440.

CVSS 2.0 · 10.0 Critical EPSS 6.3% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Air Air Sdk Air Sdk \& Compiler and 5 more
CVE-2014-8442

flash-plugin: privilege escalation from low to medium integrity level (APSB14-24)

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to complete a transition from Low Integrity to Medium Integrity by leveraging incorrect permissions.

CVSS 2.0 · 7.5 High EPSS 5.3% KEV · Not listed
Vendors
Adobe Apple Linux and 1 more
Products
Air Air Sdk Air Sdk \& Compiler and 4 more
CVE-2014-8443

flash-plugin: Multiple code-execution flaws (APSB14-27)

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 4.7% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Flash Player Mac Os X Linux Kernel and 2 more
CVE-2014-8480

kernel: kvm: NULL pointer dereference during rip relative instruction emulation

The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel before 3.18-rc2 lacks intended decoder-table flags for certain RIP-relative instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2014-8481

kernel: kvm: NULL pointer dereference during rip relative instruction emulation

The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel before 3.18-rc2 does not properly handle invalid instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application that triggers (1) an improperly fetched instruction or (2) an instruction that occupies too many bytes. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8480.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2014-8559

kernel: fs: deadlock due to incorrect usage of rename_lock

The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to cause a denial of service (deadlock and system hang) via a crafted application.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Novell and 4 more
Products
Ubuntu Linux Linux Kernel Suse Linux Enterprise Desktop and 11 more
CVE-2014-8709

kernel: net: mac80211: plain text information leak

The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets.

CVSS 2.0 · 5.0 Medium EPSS 4.5% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2014-8884

kernel: usb: buffer overflow in ttusb-dec

Stack-based buffer overflow in the ttusbdecfe_dvbs_diseqc_send_master_cmd function in drivers/media/usb/ttusb-dec/ttusbdecfe.c in the Linux kernel before 3.17.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via a large message length in an ioctl call.

CVSS 2.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus
CVE-2014-8989

kernel: Linux user namespaces can bypass group-based restrictions

The Linux kernel through 3.17.4 does not properly restrict dropping of supplemental group memberships in certain namespace scenarios, which allows local users to bypass intended file permissions by leveraging a POSIX ACL containing an entry for the group category that is more restrictive than the entry for the other category, aka a "negative groups" issue, related to kernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2014-9090

kernel: espfix64: local DoS via do_double_fault() due to improper handling of faults associated with SS segment register

The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2014-9162

flash-plugin: Information disclosure vulnerability (APSB14-27)

Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to obtain sensitive information via unspecified vectors.

CVSS 2.0 · 10.0 Critical EPSS 4.7% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Flash Player Mac Os X Linux Kernel and 2 more
CVE-2014-9164

flash-plugin: Multiple code-execution flaws (APSB14-27)

Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0587.

CVSS 2.0 · 10.0 Critical EPSS 3.7% KEV · Not listed
Vendors
Adobe Apple Linux and 2 more
Products
Flash Player Mac Os X Linux Kernel and 2 more
CVE-2014-9322

kernel: x86: local privesc due to bad_iret and paranoid entry incompatibility

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed
Vendors
Canonical Google Linux and 3 more
Products
Ubuntu Linux Android Linux Kernel and 8 more
CVE-2014-9410

kernel: DoS in drivers/media/video/msm/vfe/msm_vfe31.c via crafted ioctl call

The vfe31_proc_general function in drivers/media/video/msm/vfe/msm_vfe31.c in the MSM-VFE31 driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate a certain id value, which allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2014-9419

kernel: partial ASLR bypass through TLS base addresses leak

The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Extras Rt
CVE-2014-9420

Kernel: fs: isofs: infinite loop in CE record entries

The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2014-9428

kernel: remote denial of service via batman-adv module

The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.

CVSS 2.0 · 7.8 High EPSS 5.4% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2014-9529

kernel: use-after-free during key garbage collection

Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more