57.479 CVE tracked
782 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.479 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2014-8370 | MED 6.4 | vmware esxi VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a config | 4.2% | — |
| CVE-2014-7284 | MED 6.4 | linux linux_kernel The net_get_random_once implementation in net/core/utils.c in the Linux kernel 3.13.x and 3.14.x before 3.14.5 on certain Intel processors does not perform the intended slow-path operation to initialize random seeds, which makes it easier for remote attackers | 3.8% | — |
| CVE-2014-4948 | MED 6.4 | citrix xenserver Unspecified vulnerability in Citrix XenServer 6.2 Service Pack 1 and earlier allows attackers to cause a denial of service and obtain sensitive information by modifying the guest virtual hard disk (VHD). | 1.9% | — |
| CVE-2014-3500 | MED 6.4 | apache cordova Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL. | 4.1% | — |
| CVE-2014-3308 | MED 6.4 | cisco asr_9000_rsp440_router Cisco IOS XR on Trident line cards in ASR 9000 devices lacks a static punt policer, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted packets, aka Bug ID CSCun83985. | 2.8% | — |
| CVE-2014-2783 | MED 6.4 | microsoft internet_explorer Microsoft Internet Explorer 7 through 11 does not prevent use of wildcard EV SSL certificates, which might allow remote attackers to spoof a trust level by leveraging improper issuance of a wildcard certificate by a recognized Certification Authority, aka "Ext | 8.6% | — |
| CVE-2014-0675 | MED 6.4 | cisco telepresence_video_communication_server The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessi | 1.6% | — |
| CVE-2014-0503 | MED 6.4 | adobe flash_player Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, allows remote attackers to bypass the Same Origin Policy via unspecified vectors. | 4.3% | — |
| CVE-2014-0227 | MED 6.4 | apache tomcat java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to c | 21.0% | — |
| CVE-2013-6682 | MED 6.4 | cisco adaptive_security_appliance_software The phone-proxy implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0.3.6 and earlier does not properly validate X.509 certificates, which allows remote attackers to cause a denial of service (connection-database corruption) via an invalid ent | 0.7% | — |
| CVE-2013-6408 | MED 6.4 | apache solr The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity refer | 11.4% | — |
| CVE-2013-6407 | MED 6.4 | apache solr The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. | 11.4% | — |
| CVE-2013-5552 | MED 6.4 | cisco content_services_gateway Cisco IOS 12.4(24)MDB9 and earlier on Content Services Gateway (CSG) devices does not properly implement the "parse error drop" feature, which allows remote attackers to bypass intended access restrictions via a crafted series of packets, aka Bug ID CSCug90143 | 1.2% | — |
| CVE-2013-5535 | MED 6.4 | cisco video_surveillance_4000_ip_camera The analytics page on Cisco Video Surveillance 4000 IP cameras has hardcoded credentials, which allows remote attackers to watch the video feed by leveraging knowledge of the password, aka Bug IDs CSCuj70402 and CSCuj70419. | 1.2% | — |
| CVE-2013-3060 | MED 6.4 | apache activemq The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests. | 6.3% | — |
| CVE-2013-1131 | MED 6.4 | cisco small_business_wireless_access_ppoints Cisco Small Business Wireless Access Points WAP200, WAP2000, WAP200E, and WET200 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SSID that is not properly handled during a site survey, aka Bug IDs CSC | 0.5% | — |
| CVE-2012-5575 | MED 6.4 | apache cxf Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force | 6.3% | — |
| CVE-2012-5351 | MED 6.4 | apache axis2 Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418. | 5.1% | — |
| CVE-2012-5032 | MED 6.4 | cisco ios The Flex-VPN load-balancing feature in the ipsec-ikev2 implementation in Cisco IOS before 15.1(1)SY3 does not require authentication, which allows remote attackers to trigger the forwarding of VPN traffic to an attacker-controlled destination, or the discardin | 1.3% | — |
| CVE-2012-1472 | MED 6.4 | vmware vcenter_chargeback_manager VMware vCenter Chargeback Manager (aka CBM) before 2.0.1 does not properly handle XML API requests, which allows remote attackers to read arbitrary files or cause a denial of service via unspecified vectors. | 1.9% | — |
| CVE-2012-1194 | MED 6.4 | microsoft windows_server_2008 The resolver in the DNS Server service in Microsoft Windows Server 2008 before R2 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvabi | 10.6% | — |
| CVE-2012-0584 | MED 6.4 | apple safari The Internationalized Domain Name (IDN) feature in Apple Safari before 5.1.4 on Windows does not properly restrict the characters in URLs, which allows remote attackers to spoof a domain name via unspecified homoglyphs. | 1.4% | — |
| CVE-2012-0393 | MED 6.4 | apache struts The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object. | 36.3% | — |
| CVE-2012-0334 | MED 6.4 | cisco ironport_web_security_appliance Cisco IronPort Web Security Appliance AsyncOS software prior to 7.5 has a SSL Certificate Caching vulnerability which could allow man-in-the-middle attacks | 0.3% | — |
| CVE-2011-4914 | MED 6.4 | linux linux_kernel The ROSE protocol implementation in the Linux kernel before 2.6.39 does not verify that certain data-length values are consistent with the amount of data sent, which might allow remote attackers to obtain sensitive information from kernel memory or cause a den | 8.8% | — |