VYPR
← Canonical

Vendor CVEs

Canonical

All CVEs

2,026 total · sorted by risk
  • CVE-2014-9471Jan 16, 2015
    GNU
    Coreutils
    risk 0.01cvss —epss 0.07

    The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the "--date=TZ="123"345" @1" string to the touch or date command.

  • CVE-2014-8150Jan 15, 2015
    Curl
    Libcurl
    risk 0.01cvss —epss 0.07

    CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL.

  • CVE-2014-3583Dec 15, 2014
    Apache
    HTTP Server
    risk 0.01cvss —epss 0.11

    The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.

  • CVE-2014-8485Dec 9, 2014
    GNU
    Binutils
    risk 0.01cvss —epss 0.07

    The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers in an ELF file.

  • CVE-2014-3581Oct 10, 2014
    Apache
    HTTP Server
    risk 0.01cvss —epss 0.13

    The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.

  • CVE-2014-3618Sep 8, 2014
    Procmail
    Procmail
    risk 0.01cvss —epss 0.09

    Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."

  • CVE-2014-5461Sep 4, 2014
    Lua
    Lua
    risk 0.01cvss —epss 0.12

    Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.

  • CVE-2014-3528Aug 19, 2014
    Apache
    Subversion
    risk 0.01cvss —epss 0.07

    Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.

  • CVE-2014-2421Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

  • CVE-2014-0457Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in Oracle Java SE 5.0u61, SE 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

  • CVE-2014-0456Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

  • CVE-2014-0429Apr 16, 2014
    Sun Corporation
    Java SE
    risk 0.01cvss —epss 0.08

    Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

  • CVE-2013-4496Mar 14, 2014
    Samba (software)
    Samba
    risk 0.01cvss —epss 0.11

    Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access via brute-force ChangePasswordUser2 (1) SAMR or (2) RAP attempts.

  • CVE-2013-6393Feb 6, 2014
    YAML
    Libyaml
    risk 0.01cvss —epss 0.09

    The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a…

  • CVE-2014-1488Feb 6, 2014
    Seamonkey
    Seamonkey
    risk 0.01cvss —epss 0.07

    The Web workers implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving termination of a worker process that has performed a cross-thread object-passing operation in conjunction with use of…

  • CVE-2014-1478Feb 6, 2014
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the…

  • CVE-2013-5610Dec 11, 2013
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

  • CVE-2013-4473Nov 23, 2013
    Xorg
    Poppler
    risk 0.01cvss —epss 0.07

    Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a source filename.

  • CVE-2013-6629Nov 19, 2013
    Google
    Chrome
    risk 0.01cvss —epss 0.10

    The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of…

  • CVE-2013-4475Nov 13, 2013
    Samba (software)
    Samba
    risk 0.01cvss —epss 0.09

    Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate…

  • CVE-2013-5842Oct 16, 2013
    Oracle Corporation
    Java SE Embedded
    risk 0.01cvss —epss 0.18

    Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a…

  • CVE-2013-5830Oct 16, 2013
    Oracle Corporation
    Jrockit
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and…

  • CVE-2013-5829Oct 16, 2013
    Sun Corporation
    Java SE
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different…

  • CVE-2012-5689Jan 25, 2013
    Isc
    Bind
    risk 0.01cvss —epss 0.12

    ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an…

  • CVE-2013-0768Jan 13, 2013
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.08

    Stack-based buffer overflow in the Canvas implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via an HTML…

  • CVE-2013-0755Jan 13, 2013
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Use-after-free vulnerability in the mozVibrate implementation in the Vibrate library in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute…

  • CVE-2013-0752Jan 13, 2013
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XBL file with…

  • CVE-2013-0750Jan 13, 2013
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.06

    Integer overflow in the JavaScript implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to…

  • CVE-2012-5688Dec 6, 2012
    Isc
    Bind
    risk 0.01cvss —epss 0.11

    ISC BIND 9.8.x before 9.8.4-P1 and 9.9.x before 9.9.2-P1, when DNS64 is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.

  • CVE-2012-5839Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in the gfxShapedWord::CompressedGlyph::IsClusterStart function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute…

  • CVE-2012-5835Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.09

    Integer overflow in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service…

  • CVE-2012-5829Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in the nsWindow::OnExposeEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via…

  • CVE-2012-4202Nov 21, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.11

    Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code…

  • CVE-2012-4564Nov 11, 2012
    LibTIFF
    Libtiff
    risk 0.01cvss —epss 0.14

    ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based…

  • CVE-2012-5783Nov 4, 2012
    Apache
    Httpclient
    risk 0.01cvss —epss 0.09

    Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows…

  • CVE-2012-4188Oct 10, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.15

    Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2012-4187Oct 10, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly manage a certain insPos variable, which allows remote attackers to execute arbitrary code or cause a denial of…

  • CVE-2012-4186Oct 10, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.15

    Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via…

  • CVE-2012-4185Oct 10, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.09

    Buffer overflow in the nsCharTraits::length function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of…

  • CVE-2012-4180Oct 10, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.09

    Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary…

  • CVE-2012-3961Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.07

    Use-after-free vulnerability in the RangeData implementation in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial…

  • CVE-2012-3957Aug 29, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in the nsBlockFrame::MarkLineDirty function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code via…

  • CVE-2012-2665Aug 6, 2012
    Libreoffice
    Libreoffice
    risk 0.01cvss —epss 0.07

    Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Open Document Text (.odt) file with…

  • CVE-2011-3193Jun 16, 2012
    Qt
    Qt
    risk 0.01cvss —epss 0.08

    Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.

  • CVE-2012-0444Feb 1, 2012
    Mozilla Corporation
    Firefox
    risk 0.01cvss —epss 0.08

    Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash)…

  • CVE-2011-4517Dec 15, 2011
    Jasper
    JasPer
    risk 0.01cvss —epss 0.11

    The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory…

  • CVE-2011-4516Dec 15, 2011
    Jasper
    JasPer
    risk 0.01cvss —epss 0.11

    Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker…

  • CVE-2011-4539Dec 8, 2011
    Isc
    DHCP
    risk 0.01cvss —epss 0.15

    dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

  • CVE-2011-4566Nov 29, 2011
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in…

  • CVE-2011-2694Jul 29, 2011
    Samba (software)
    Samba
    risk 0.01cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd…

Page 19 of 41