VYPR
← OpenSUSE

Vendor CVEs

OpenSUSE

All CVEs

1,697 total · sorted by risk
  • CVE-2016-1664MedMay 14, 2016
    Google
    Chrome
    risk 0.28cvss 4.3epss 0.01

    The HistoryController::UpdateForCommit function in content/renderer/history_controller.cc in Google Chrome before 50.0.2661.94 mishandles the interaction between subframe forward navigations and other forward navigations, which allows remote attackers to spoof the address bar…

  • CVE-2016-1658MedApr 18, 2016
    Google
    Chrome
    risk 0.28cvss 4.3epss 0.01

    The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted extension.

  • CVE-2016-1657MedApr 18, 2016
    Google
    Chrome
    risk 0.28cvss 4.3epss 0.01

    The WebContentsImpl::FocusLocationBarByDefault function in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 50.0.2661.75 mishandles focus for certain about:blank pages, which allows remote attackers to spoof the address bar via a crafted URL.

  • CVE-2016-1965MedMar 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.28cvss 4.3epss 0.02

    Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.

  • CVE-2016-1958MedMar 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.28cvss 4.3epss 0.02

    browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL.

  • CVE-2016-1957MedMar 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.28cvss 4.3epss 0.02

    Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array.

  • CVE-2016-1955MedMar 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.28cvss 4.3epss 0.02

    Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element.

  • CVE-2016-2043MedFeb 20, 2016
    PhpMyAdmin
    phpMyAdmin
    risk 0.28cvss 5.4epss 0.01

    Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page.

  • CVE-2016-2042MedFeb 20, 2016
    PhpMyAdmin
    phpMyAdmin
    risk 0.28cvss 5.3epss 0.02

    phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or (2) libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message.

  • CVE-2016-2040MedFeb 20, 2016
    PhpMyAdmin
    phpMyAdmin
    risk 0.28cvss 5.4epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname…

  • CVE-2016-2039MedFeb 20, 2016
    PhpMyAdmin
    phpMyAdmin
    risk 0.28cvss 5.3epss 0.02

    libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value.

  • CVE-2016-2038MedFeb 20, 2016
    PhpMyAdmin
    phpMyAdmin
    risk 0.28cvss 5.3epss 0.03

    phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.

  • CVE-2016-1626MedFeb 14, 2016
    Google
    Chrome
    risk 0.28cvss 4.3epss 0.01

    The opj_pi_update_decode_poc function in pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, miscalculates a certain layer index value, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.

  • CVE-2016-1625MedFeb 14, 2016
    Google
    Chrome
    risk 0.28cvss 4.3epss 0.01

    The Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab Page (NTP) navigation target is on the most-visited or suggestions list, which allows remote attackers to bypass intended restrictions via unspecified vectors, related to…

  • CVE-2015-8629MedFeb 13, 2016
    Mit
    Kerberos 5
    risk 0.28cvss 5.3epss 0.04

    The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a…

  • CVE-2015-8792MedJan 29, 2016
    Matroska Org
    Libmatroska
    risk 0.28cvss 5.3epss 0.01

    The KaxInternalBlock::ReadData function in libMatroska before 1.4.4 allows context-dependent attackers to obtain sensitive information from process heap memory via crafted EBML lacing, which triggers an invalid memory access.

  • CVE-2016-1494MedJan 13, 2016
    Python (programming language)
    Rsa
    risk 0.28cvss 5.3epss 0.07

    The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.

  • CVE-2016-0668MedApr 21, 2016
    MariaDB
    MariaDB
    risk 0.27cvss 4.1epss 0.01

    Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to InnoDB.

  • CVE-2018-12477LowOct 9, 2018
    OpenSUSE
    Build service
    risk 0.23cvss 3.5epss 0.01

    A Improper Neutralization of CRLF Sequences vulnerability in Open Build Service allows remote attackers to cause deletion of directories by tricking obs-service-refresh_patches to delete them. Affected releases are openSUSE Open Build Service: versions prior to…

  • CVE-2017-5930LowMar 20, 2017
    Postfixadmin Project
    Postfixadmin
    risk 0.22cvss 2.7epss 0.15

    The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.

  • CVE-2016-0643LowApr 21, 2016
    MariaDB
    MariaDB
    risk 0.22cvss 3.3epss 0.02

    Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect confidentiality via vectors related to DML.

  • CVE-2014-8134LowDec 12, 2014
    Linux
    Kernel
    risk 0.22cvss 3.3epss 0.01

    The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a…

  • CVE-2014-9770LowApr 20, 2016
    OpenSUSE
    openSUSE
    risk 0.21cvss 3.3epss 0.00

    tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal/%m, which allows local users to obtain sensitive information by reading these files.

  • CVE-2015-7758LowJan 8, 2016
    Gummi
    Gummi
    risk 0.21cvss 3.3epss 0.00

    Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out, (4) .pdf, or (5) .toc extension for the file name, as demonstrated by .thesis.tex.aux.

  • CVE-2016-5166LowSep 11, 2016
    Google
    Chrome
    risk 0.20cvss 3.1epss 0.01

    The download implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly restrict saving a file:// URL that is referenced by an http:// URL, which makes it easier for user-assisted remote attackers to discover…

  • CVE-2015-8842LowApr 20, 2016
    Systemd Project
    Systemd
    risk 0.14cvss 3.3epss 0.00

    tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the file.

  • CVE-2014-0195Jun 5, 2014
    OpenSSL Project
    OpenSSL
    risk 0.11cvss —epss 1.00

    The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of…

  • CVE-2013-5211Jan 2, 2014
    NTP
    NTP
    risk 0.11cvss —epss 0.98

    The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.

  • CVE-2011-3192Aug 29, 2011
    Apache
    HTTP Server
    risk 0.11cvss —epss 0.99

    The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in…

  • CVE-2014-0569Oct 15, 2014
    Adobe Inc.
    Air SDK
    risk 0.10cvss —epss 0.90

    Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allows attackers to…

  • CVE-2012-0053Jan 28, 2012
    Apache
    HTTP Server
    risk 0.10cvss —epss 0.83

    protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2)…

  • CVE-2009-1185Apr 17, 2009
    Udev
    udev
    risk 0.10cvss —epss 0.82

    udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.

  • CVE-2013-4123Sep 16, 2013
    Squid Cache
    Squid
    risk 0.09cvss —epss 0.80

    client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header.

  • CVE-2013-4124Aug 6, 2013
    Samba (software)
    Samba
    risk 0.09cvss —epss 0.69

    Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet.

  • CVE-2013-0758Jan 13, 2013
    Mozilla Corporation
    Firefox
    risk 0.09cvss —epss 0.73

    Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome…

  • CVE-2011-0762Mar 2, 2011
    Vsftpd Project
    Vsftpd
    risk 0.09cvss —epss 0.73

    The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability…

  • CVE-2015-0802Apr 1, 2015
    Mozilla Corporation
    Firefox
    risk 0.08cvss —epss 0.67

    Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages…

  • CVE-2013-4547Nov 23, 2013
    Nginx
    Nginx
    risk 0.08cvss —epss 0.68

    nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.

  • CVE-2013-1362Jul 9, 2013
    Nagios
    NRPE
    risk 0.08cvss —epss 0.66

    Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash.

  • CVE-2013-4074Jun 9, 2013
    Wireshark
    Wireshark
    risk 0.08cvss —epss 0.61

    The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 incorrectly uses a -1 data value to represent an error condition, which allows remote attackers to cause a denial of service…

  • CVE-2013-0757Jan 13, 2013
    Mozilla Corporation
    Firefox
    risk 0.08cvss —epss 0.61

    The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows…

  • CVE-2015-5134Aug 14, 2015
    Adobe Inc.
    Air
    risk 0.07cvss —epss 0.49

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via…

  • CVE-2015-5133Aug 14, 2015
    Adobe Inc.
    Air
    risk 0.07cvss —epss 0.51

    Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified…

  • CVE-2015-5132Aug 14, 2015
    Adobe Inc.
    Air
    risk 0.07cvss —epss 0.51

    Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified…

  • CVE-2015-5131Aug 14, 2015
    Adobe Inc.
    Air
    risk 0.07cvss —epss 0.51

    Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified…

  • CVE-2015-5130Aug 14, 2015
    Adobe Inc.
    Air
    risk 0.07cvss —epss 0.49

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via…

  • CVE-2015-5127Aug 14, 2015
    Adobe Inc.
    Air
    risk 0.07cvss —epss 0.49

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via…

  • CVE-2014-3470Jun 5, 2014
    OpenSSL Project
    OpenSSL
    risk 0.07cvss —epss 0.86

    The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by…

  • CVE-2014-0221Jun 5, 2014
    OpenSSL Project
    OpenSSL
    risk 0.07cvss —epss 0.88

    The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

  • CVE-2013-0753Jan 13, 2013
    Mozilla Corporation
    Firefox
    risk 0.07cvss —epss 0.51

    Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and…

Page 14 of 34