Export limit exceeded: 17088 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,088

Export CSV
CVE-2007-5269

libpng DoS via multiple out-of-bounds reads

Certain chunk handlers in libpng before 1.0.29 and 1.2.x before 1.2.21 allow remote attackers to cause a denial of service (crash) via crafted (1) pCAL (png_handle_pCAL), (2) sCAL (png_handle_sCAL), (3) tEXt (png_push_read_tEXt), (4) iTXt (png_handle_iTXt), and (5) ztXT (png_handle_ztXt) chunking in PNG images, which trigger out-of-bounds read operations.

CVSS 2.0 · 5.0 Medium EPSS 4.8% KEV · Not listed
Vendors
Libpng Redhat
Products
Libpng Enterprise Linux
CVE-2007-5333

Improve cookie parsing for tomcat5

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.

CVSS 2.0 · 5.0 Medium EPSS 62.6% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Certificate System Enterprise Linux and 4 more
CVE-2007-5334

security flaw

Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 can hide the window's titlebar when displaying XUL markup language documents, which makes it easier for remote attackers to conduct phishing and spoofing attacks by setting the hidechrome attribute.

CVSS 2.0 · 4.3 Medium EPSS 3.0% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Enterprise Linux
CVE-2007-5337

security flaw

Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5, when running on Linux systems with gnome-vfs support, might allow remote attackers to read arbitrary files on SSH/sftp servers that accept key authentication by creating a web page on the target server, in which the web page contains URIs with (1) smb: or (2) sftp: schemes that access other files from the server.

CVSS 2.0 · 4.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Gnome Linux Mozilla and 1 more
Products
Gnome-vfs Linux Kernel Firefox and 2 more
CVE-2007-5338

security flaw

Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allow remote attackers to execute arbitrary Javascript with user privileges by using the Script object to modify XPCNativeWrappers in a way that causes the script to be executed when a chrome action is performed.

CVSS 2.0 · 9.3 Critical EPSS 3.2% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Enterprise Linux
CVE-2007-5339

security flaw

Multiple vulnerabilities in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption or assert errors.

CVSS 2.0 · 4.3 Medium EPSS 3.4% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Thunderbird and 1 more
CVE-2007-5340

security flaw

Multiple vulnerabilities in the Javascript engine in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption.

CVSS 2.0 · 4.3 Medium EPSS 3.4% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Thunderbird and 1 more
CVE-2007-5342

Apache Tomcat's default security policy is too open

The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.

CVSS 2.0 · 6.4 Medium EPSS 5.2% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Enterprise Application Platform and 2 more
CVE-2007-5365

dhcpd stack-based buffer overlow

Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.

CVSS 2.0 · 7.2 High EPSS 80.3% KEV · Not listed
Vendors
Debian Openbsd Redhat and 2 more
Products
Debian Linux Openbsd Enterprise Linux and 4 more
CVE-2007-5378

Tk GIF processing buffer overflow

Buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and earlier, and 8.3.5 and earlier, allows user-assisted attackers to cause a denial of service (segmentation fault) via an animated GIF in which the first subimage is smaller than a subsequent subimage, which triggers the overflow in the ReadImage function, a different vulnerability than CVE-2007-5137.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Redhat Tcl Tk
Products
Enterprise Linux Tk Toolkit
CVE-2007-5392

DCTStream:: reset()

Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 6.4% KEV · Not listed
Vendors
Redhat Xpdf
Products
Enterprise Linux Xpdf
CVE-2007-5393

CCITTFaxStream:: lookChar()

Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.

CVSS 2.0 · 9.3 Critical EPSS 6.4% KEV · Not listed
Vendors
Redhat Xpdf
Products
Enterprise Linux Xpdf
CVE-2007-5398

Samba "reply_netbios_packet()" Buffer Overflow Vulnerability

Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operating as a WINS server, allows remote attackers to execute arbitrary code via crafted WINS Name Registration requests followed by a WINS Name Query request.

CVSS 2.0 · 9.3 Critical EPSS 11.4% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Rhel Eus Samba
CVE-2007-5461

Absolute path traversal Apache Tomcat WEBDAV

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

CVSS 2.0 · 3.5 Low EPSS 39.7% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Certificate System Enterprise Linux and 5 more
CVE-2007-5494

open(O_ATOMICLOOKUP) leaks dentry

Memory leak in the Red Hat Content Accelerator kernel patch in Red Hat Enterprise Linux (RHEL) 4 and 5 allows local users to cause a denial of service (memory consumption) via a large number of open requests involving O_ATOMICLOOKUP.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2007-5496

setroubleshoot log injection

Cross-site scripting (XSS) vulnerability in setroubleshoot 2.0.5 allows local users to inject arbitrary web script or HTML via a crafted (1) file or (2) process name, which triggers an Access Vector Cache (AVC) log entry in a log file used during composition of HTML documents for sealert.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Redhat Selinux
Products
Enterprise Linux Enterprise Linux Desktop Setroubleshoot
CVE-2007-5498

missing sanity check in xen block backend driver

The Xen hypervisor block backend driver for Linux kernel 2.6.18, when running on a 64-bit host with a 32-bit paravirtualized guest, allows local privileged users in the guest OS to cause a denial of service (host OS crash) via a request that specifies a large number of blocks.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2007-5500

kernel hang via userspace PTRACE+waitid

The wait_task_stopped function in the Linux kernel before 2.6.23.8 checks a TASK_TRACED bit instead of an exit_state value, which allows local users to cause a denial of service (machine crash) via unspecified vectors. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux