Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (26303 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2016-9383 2 Citrix, Xen 2 Xenserver, Xen 2025-04-20 N/A
Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.
CVE-2016-6668 1 Atlassian 2 Confluence Server, Jira Integration For Hipchat 2025-04-20 7.5 High
The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17; and HipChat for JIRA plugin 6.26.0 before 7.8.17 allows remote attackers to obtain the secret key for communicating with HipChat instances by reading unspecified pages.
CVE-2016-6603 1 Zohocorp 1 Webnms Framework 2025-04-20 N/A
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.
CVE-2015-1554 1 Kgb-bot Project 1 Kgb-bot 2025-04-20 N/A
kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash).
CVE-2015-1555 1 Zend 1 Zend Framework 2025-04-20 N/A
Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators.
CVE-2017-5017 2 Google, Redhat 2 Chrome, Rhel Extras 2025-04-20 N/A
Interactions with the OS in Google Chrome prior to 56.0.2924.76 for Mac insufficiently cleared video memory, which allowed a remote attacker to possibly extract image fragments on systems with GeForce 8600M graphics chips via a crafted HTML page.
CVE-2015-1800 1 Samsung 2 Galaxy S4, Galaxy S4 Firmware 2025-04-20 N/A
The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive information.
CVE-2015-3142 1 Redhat 2 Automatic Bug Reporting Tool, Enterprise Linux 2025-04-20 N/A
The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensitive information by leveraging write permissions to the working directory of a crashed application.
CVE-2015-3277 1 Mod Nss Project 1 Mod Nss 2025-04-20 N/A
The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherstring.
CVE-2015-5070 2 Fedoraproject, Wesnoth 2 Fedora, Battle For Wesnoth 2025-04-20 N/A
The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
CVE-2014-9755 1 Viprinet 2 Multichannel Vpn Router 300, Multichannel Vpn Router 300 Firmware 2025-04-20 N/A
The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows remote attackers to perform a replay attack.
CVE-2014-9754 1 Viprinet 2 Multichannel Vpn Router 300, Multichannel Vpn Router 300 Firmware 2025-04-20 N/A
The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity (through the checking of the endpoint's SSL key) before initiating the exchange, which allows an attacker to perform a Man in the Middle attack.
CVE-2015-5173 2 Cloudfoundry, Pivotal Software 3 Cf-release, Cloud Foundry Elastic Runtime, Cloud Foundry Uaa 2025-04-20 8.8 High
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."
CVE-2015-5175 1 Apache 1 Cxf Fediz 2025-04-20 N/A
Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.
CVE-2015-5186 1 Linux Audit Project 1 Linux Audit 2025-04-20 N/A
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
CVE-2015-5187 1 Candlepinproject 1 Candlepin 2025-04-20 N/A
Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffic.
CVE-2017-9554 1 Synology 1 Diskstation Manager 2025-04-20 N/A
An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.
CVE-2015-5959 1 Froxlor 1 Froxlor 2025-04-20 N/A
Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log.
CVE-2015-6668 1 Wp-jobmanager 1 Job Manager 2025-04-20 N/A
The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference.
CVE-2015-6671 1 Edx 1 Edx-platform 2025-04-20 5.9 Medium
Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup.