Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.7GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_Check if you run itEPSS 0.53%Dec 26, 2018
- High7.5In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closedCheck if you run itEPSS 5.53%Dec 4, 2018
- Critical9.8International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/number_decimalquantity.cpp.Check if you run itEPSS 2.90%Nov 4, 2018
- Medium6.5Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and otherCheck if you run itEPSS 2.54%Aug 28, 2018
- Medium6.5libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrateCheck if you run itEPSS 4.35%Aug 16, 2018
- High7.5A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND oCheck if you run itEPSS 3.75%Jul 19, 2018
- Medium4.7Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing prCheck if you run itEPSS 0.89%Jun 13, 2018
- Medium5.3The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.Check if you run itEPSS 2.83%Jun 7, 2018
- Medium6.5The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functCheck if you run itEPSS 2.74%Apr 8, 2018
- Critical9.8A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loadiCheck if you run itEPSS 2.98%Feb 19, 2018
- High7.5parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.Check if you run itEPSS 6.45%Nov 23, 2017
- Critical9.8parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTCheck if you run itEPSS 4.58%Nov 23, 2017
- High7.8A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process.Check if you run itEPSS 2.31%Jun 14, 2017
- High7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c.Check if you run itEPSS 4.63%May 18, 2017
- High7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow.Check if you run itEPSS 4.85%May 18, 2017
- High7.1The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a craftedCheck if you run itEPSS 2.76%Feb 3, 2017
- Critical10.0Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confideCheck if you run itEPSS 7.21%Jan 21, 2016
- Medium5.9Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key ExcCheck if you run itEPSS 2.90%Jan 9, 2016
- Critical10.0Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.Check if you run itEPSS 7.09%Jul 16, 2015
- Low1.9cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.Check if you run itEPSS 2.91%Feb 19, 2015
- Medium4.3The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgPatch nowKEVEPSS 98.69%Jan 9, 2015
1,171 records · page 47 of 47
PreviousNext