56.663 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.663 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2014-0048 | CRIT 9.8 | apache geode An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways. | 6.5% | — |
| CVE-2014-0030 | CRIT 9.8 | apache roller The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. | 16.9% | — |
| CVE-2013-7285 | CRIT 9.8 | apache activemq Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. | 84.4% | — |
| CVE-2013-5122 | CRIT 9.8 | cisco linksys_e4200_firmware Cisco Linksys Routers EA2700, EA3500, E4200, EA4500: A bug can cause an unsafe TCP port to open which leads to unauthenticated access | 3.7% | — |
| CVE-2013-4486 | CRIT 9.8 | redhat zanata Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging | 1.5% | — |
| CVE-2013-4366 | CRIT 9.8 | apache httpclient http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification. | 2.2% | — |
| CVE-2013-2681 | CRIT 9.8 | cisco linksys_e4200_firmware Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to gain unauthorized access. | 10.1% | — |
| CVE-2013-2251 | CRIT 9.8 | apache archiva Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix. | 100.0% | |
| CVE-2013-0625 | CRIT 9.8 | adobe coldfusion Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013. | 93.8% | |
| CVE-2012-6712 | CRIT 9.8 | linux linux_kernel In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless/iwlwifi/iwl-agn-sta.c, which will cause at least memory corruption. | 3.0% | — |
| CVE-2012-4449 | CRIT 9.8 | apache hadoop Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack. | 1.2% | — |
| CVE-2012-1891 | CRIT 9.8 | microsoft data_access_components Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via crafted XML data that triggers access to an uninitialized object in memory | 29.4% | — |
| CVE-2012-1622 | CRIT 9.8 | apache ofbiz Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors. | 5.0% | — |
| CVE-2012-0803 | CRIT 9.8 | apache cxf The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request. | 3.5% | — |
| CVE-2012-0391 | CRIT 9.8 | apache struts The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a craft | 76.0% | |
| CVE-2011-5327 | CRIT 9.8 | linux linux_kernel In the Linux kernel before 3.1, an off by one in the drivers/target/loopback/tcm_loop.c tcm_loop_make_naa_tpg() function could result in at least memory corruption. | 3.7% | — |
| CVE-2011-4373 | CRIT 9.8 | adobe acrobat Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-4370 and CVE-2011-4 | 30.6% | — |
| CVE-2011-4372 | CRIT 9.8 | adobe acrobat Adobe Reader and Acrobat before 9.5, and 10.x before 10.1.2, on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-4370 and CVE-2011-4 | 12.8% | — |
| CVE-2011-4120 | CRIT 9.8 | debian debian_linux Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentic | 2.0% | — |
| CVE-2011-3923 | CRIT 9.8 | apache struts Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. | 89.5% | — |
| CVE-2011-2767 | CRIT 9.8 | apache mod_perl mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP re | 8.9% | — |
| CVE-2011-2462 | CRIT 9.8 | adobe acrobat Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption | 86.6% | |
| CVE-2011-2013 | CRIT 9.8 | microsoft windows_7 Integer overflow in the TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code by sending a sequence of crafted UDP packets to a closed port, a | 33.7% | — |
| CVE-2011-1889 | CRIT 9.8 | microsoft forefront_threat_management_gateway The NSPLookupServiceNext function in the client in Microsoft Forefront Threat Management Gateway (TMG) 2010 allows remote attackers to execute arbitrary code via vectors involving unspecified requests, aka "TMG Firewall Client Memory Corruption Vulnerability." | 48.4% | |
| CVE-2011-1180 | CRIT 9.8 | linux linux_kernel Multiple stack-based buffer overflows in the iriap_getvaluebyclass_indication function in net/irda/iriap.c in the Linux kernel before 2.6.39 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by le | 3.0% | — |