57.918 CVE tracked
783 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.918 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted ascending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2012-5611 | MED 6.5 | mariadb mariadb Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, al | 24.0% | — |
| CVE-2012-5030 | MED 6.5 | cisco ios Cisco IOS before 15.2(4)S6 does not initialize an unspecified variable, which might allow remote authenticated users to cause a denial of service (CPU consumption, watchdog timeout, crash) by walking specific SNMP objects. | 1.1% | — |
| CVE-2012-1574 | MED 6.5 | apache hadoop The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allo | 4.8% | — |
| CVE-2012-1313 | MED 6.5 | cisco unified_computing_system The remote debug shell on the PALO adapter card in Cisco Unified Computing System (UCS) allows local users to gain privileges via malformed show-macstats parameters, aka Bug ID CSCub13772. | 0.4% | — |
| CVE-2012-0337 | MED 6.5 | cisco unified_meetingplace SQL injection vulnerability in the web component in Cisco Unified MeetingPlace 7.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtx08939. | 1.0% | — |
| CVE-2012-0037 | MED 6.5 | apache openoffice Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) decl | 13.7% | — |
| CVE-2011-3363 | MED 6.5 | linux linux_kernel The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a share. | 0.8% | — |
| CVE-2011-2585 | MED 6.5 | cisco show_and_share Cisco Show and Share 5(2), 5.2(1), and 5.2(2) before 5.2(2.1) allows remote authenticated users to upload and execute arbitrary code by leveraging video upload privileges, aka Bug ID CSCto69857. | 2.1% | — |
| CVE-2011-2329 | MED 6.5 | apache rampart\/c The rampart_timestamp_token_validate function in util/rampart_timestamp_token.c in Apache Rampart/C 1.3.0 does not properly calculate the expiration of timestamp tokens, which allows remote attackers to bypass intended access restrictions by leveraging an expi | 2.0% | — |
| CVE-2011-1607 | MED 6.5 | cisco unified_communications_manager Directory traversal vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5b)su3, 8.0 before 8.0(3a)su1, and 8.5 before 8.5(1) allows remote authenticated users to upload files to arbitrary | 2.3% | — |
| CVE-2011-0290 | MED 6.5 | rim blackberry_enterprise_server The BlackBerry Collaboration Service in Research In Motion (RIM) BlackBerry Enterprise Server (BES) 5.0.3 through MR4 for Microsoft Exchange and Lotus Domino allows remote authenticated users to log into arbitrary user accounts associated with the same organiz | 2.1% | — |
| CVE-2010-3330 | MED 6.5 | microsoft internet_explorer Microsoft Internet Explorer 6 through 8 does not properly restrict script access to content from a different (1) domain or (2) zone, which allows remote attackers to obtain sensitive information via a crafted web site, aka "Cross-Domain Information Disclosure | 22.3% | — |
| CVE-2010-3050 | MED 6.5 | cisco ios Cisco IOS before 12.2(33)SXI allows remote authenticated users to cause a denial of service (device reboot). | 1.1% | — |
| CVE-2010-2249 | MED 6.5 | apple iphone_os Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks. | 2.6% | — |
| CVE-2010-1282 | MED 6.5 | adobe shockwave_player Adobe Shockwave Player before 11.5.7.609 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted ATOM size in a .dir (aka Director) file. | 3.0% | — |
| CVE-2010-0488 | MED 6.5 | microsoft internet_explorer Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site, aka "Post Encoding Informatio | 29.2% | — |
| CVE-2010-0298 | MED 6.5 | debian debian_linux The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3 code, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on th | 2.4% | — |
| CVE-2010-0147 | MED 6.5 | cisco security_agent SQL injection vulnerability in the Management Center for Cisco Security Agents 5.1 before 5.1.0.117, 5.2 before 5.2.0.296, and 6.0 before 6.0.1.132 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. | 1.6% | — |
| CVE-2009-5004 | MED 6.5 | apache qpid-cpp qpid-cpp 1.0 crashes when a large message is sent and the Digest-MD5 mechanism with a security layer is in use . | 2.6% | — |
| CVE-2009-4455 | MED 6.5 | cisco adaptive_security_appliance_5500 The default configuration of Cisco ASA 5500 Series Adaptive Security Appliance (Cisco ASA) 7.0, 7.1, 7.2, 8.0, 8.1, and 8.2 allows portal traffic to access arbitrary backend servers, which might allow remote authenticated users to bypass intended access restri | 1.3% | — |
| CVE-2009-4267 | MED 6.5 | apache juddi The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof log entries via the numRows parameter. | 1.4% | — |
| CVE-2009-2495 | MED 6.5 | microsoft visual_c\+\+ The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensit | 34.3% | — |
| CVE-2009-2416 | MED 6.5 | apple iphone_os Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in | 1.8% | — |
| CVE-2009-2213 | MED 6.5 | citrix netscaler_access_gateway The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earlier specifies Allow for the Default Authorization Action option, which might allow remote authenticate | 2.0% | — |
| CVE-2008-3474 | MED 6.5 | microsoft internet_explorer Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy and obtain sensitive information via a crafted HTML document, | 28.0% | — |