Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
•added 2017/03/30 11:59 p.m.•37 views

Design/Logic Flaw

The vmwgbsurfacedefineioctl function in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.10.7 does not validate certain levels data, which allows local users to cause a denial of service system hang via a crafted ioctl call for a /dev/dri/renderD device...

4.9CVSS4.9AI score0.00378EPSS
SaveExploits0References6Affected Software1
Prion
Prion
•added 2017/03/29 8:59 p.m.•37 views

Input validation

When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox...

7.5CVSS7.6AI score0.03169EPSS
SaveExploits1References7Affected Software1
Prion
Prion
•added 2017/03/27 2:59 a.m.•37 views

Buffer overflow

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services IIS 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: http://" in a PROPFIND request, as exploited in the wild ...

10CVSS9.6AI score0.99823EPSS
SaveExploits41References10Affected Software1
Prion
Prion
•added 2017/03/17 12:59 a.m.•37 views

Remote code execution

Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows guest OS users to execute arbitrary code on the host OS via a crafted application, aka "Hyper-V Remo...

7.4CVSS7.8AI score0.1267EPSS
SaveExploits0References3Affected Software3
Prion
Prion
•added 2017/01/24 9:59 p.m.•37 views

Integer overflow

The exifconvertanytoint function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service application crash via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1...

5CVSS7AI score0.07827EPSS
SaveExploits0References11Affected Software1
Prion
Prion
•added 2016/10/16 9:59 p.m.•37 views

Design/Logic Flaw

The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service stack consumption and panic or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a relat...

7.8CVSS8AI score0.07613EPSS
SaveExploits0References11Affected Software3
Prion
Prion
•added 2016/08/07 10:59 a.m.•37 views

Double free

Double free vulnerability in the phpmbregexeregreplaceexec function in phpmbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service application crash by leveraging a callback...

7.5CVSS8.3AI score0.0963EPSS
SaveExploits1References14Affected Software1
Prion
Prion
•added 2016/08/05 1:59 a.m.•37 views

Design/Logic Flaw

Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service heap memory corruption and application crash by leveraging keyboard access to use the Alt...

7.5CVSS8.1AI score0.02953EPSS
SaveExploits0References11Affected Software3
Prion
Prion
•added 2016/07/25 2:59 p.m.•37 views

Design/Logic Flaw

The phpurlparseex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a denial of service buffer over-read or possibly have unspecified other impact via vectors involving the smartstr data type...

7.5CVSS7.9AI score0.05055EPSS
SaveExploits0References9Affected Software1
Prion
Prion
•added 2016/07/21 10:14 a.m.•37 views

Design/Logic Flaw

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR...

4CVSS6AI score0.03703EPSS
SaveExploits0References19Affected Software12
Prion
Prion
•added 2016/06/03 2:59 p.m.•37 views

Design/Logic Flaw

The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 6.0.16.25, 6 R1 before SR8 FP25 6.1.8.25, 7 before SR9 FP40 7.0.9.40, 7 R1 before SR3 FP40 7.1.3.40, and 8 before SR3 8.0.3.0 uses the invoke method of the java.lang.reflect.Method class in an...

6.8CVSS8.3AI score0.04382EPSS
SaveExploits0References22Affected Software13
Prion
Prion
•added 2016/05/16 10:59 a.m.•37 views

Null pointer dereference

The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation after the principal argument...

5CVSS7.3AI score0.07276EPSS
SaveExploits0References6Affected Software2
Prion
Prion
•added 2016/05/16 10:59 a.m.•37 views

Sql injection

ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152...

4.3CVSS6.8AI score0.07083EPSS
SaveExploits1References9Affected Software1
Prion
Prion
•added 2016/05/16 10:59 a.m.•37 views

Null pointer dereference

The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation during initial error checking,...

5CVSS7.3AI score0.07276EPSS
SaveExploits0References6Affected Software2
Prion
Prion
•added 2016/05/16 10:59 a.m.•37 views

Design/Logic Flaw

Use-after-free vulnerability in the splptrheapinsert function in ext/spl/splheap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation...

7.5CVSS8.1AI score0.05466EPSS
SaveExploits1References5Affected Software2
Prion
Prion
•added 2016/03/03 8:59 p.m.•37 views

Double free

Double free vulnerability in the dsaprivdecode function in crypto/dsa/dsaameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via a malformed DSA private key...

10CVSS9.7AI score0.26335EPSS
SaveExploits1References57Affected Software5
Prion
Prion
•added 2016/03/03 8:59 p.m.•37 views

Out-of-bounds

The doaproutch function in crypto/bio/bprint.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service out-of-bounds write or memory consumption or possibly have unspecified other...

10CVSS9.7AI score0.53655EPSS
SaveExploits1References27Affected Software1
Prion
Prion
•added 2015/12/02 1:59 a.m.•37 views

Buffer overflow

PCRE before 8.38 mishandles the /?J?'d'?'d'\gd/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service buffer overflow or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScri...

7.5CVSS7.6AI score0.03558EPSS
SaveExploits0References6Affected Software1
Prion
Prion
•added 2015/12/02 1:59 a.m.•37 views

Heap overflow

The pcreexec function in pcreexec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegE...

7.5CVSS7.9AI score0.04436EPSS
SaveExploits1References8Affected Software2
Prion
Prion
•added 2015/11/11 11:59 a.m.•37 views

Memory corruption

Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6078...

9.3CVSS7.8AI score0.19436EPSS
SaveExploits0References4Affected Software1
Prion
Prion
•added 2015/08/26 7:59 p.m.•37 views

Information disclosure

The slirpsmb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service instantiation failure by creating /tmp/qemu-smb.- files before the program...

1.9CVSS6.3AI score0.00372EPSS
SaveExploits0References14Affected Software1
Prion
Prion
•added 2015/07/26 10:59 p.m.•37 views

Cross site request forgery (csrf)

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelistedips protection mechanism via a crafted request...

4.3CVSS6.9AI score0.44984EPSS
SaveExploits6References5Affected Software1
Prion
Prion
•added 2015/07/16 11:0 a.m.•37 views

Buffer overflow

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.1.0, 12.1.2.0, and 12.1.3.0 allows remote attackers to affect integrity via unknown vectors...

2.6CVSS6.3AI score0.01792EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2015/06/10 1:59 a.m.•37 views

Memory corruption

Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability."...

9.3CVSS8AI score0.35105EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2015/04/13 2:59 p.m.•37 views

Cross site scripting

Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...

4.3CVSS6.1AI score0.02095EPSS
SaveExploits1References6Affected Software1
Prion
Prion
•added 2015/03/30 10:59 a.m.•37 views

Design/Logic Flaw

Use-after-free vulnerability in the zendsharedmemdup function in zendsharedalloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

7.5CVSS7.8AI score0.08646EPSS
SaveExploits1References13Affected Software5
Prion
Prion
•added 2015/03/24 5:59 p.m.•37 views

Xxe

XML external entity XXE vulnerability in the SVG to 1 PNG and 2 JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file...

6.4CVSS7AI score0.16564EPSS
SaveExploits1References11Affected Software3
Prion
Prion
•added 2015/02/25 11:59 a.m.•37 views

Design/Logic Flaw

Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 on Windows, when the Maintenance Service is not used, allow local users to gain privileges via a Trojan horse DLL in 1 the current working...

6.9CVSS7.1AI score0.00328EPSS
SaveExploits0References10Affected Software5
Prion
Prion
•added 2015/02/11 3:1 a.m.•37 views

Double free

Double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a crafted application, aka "Windows Cursor Object Double Free Vulnerability."...

7.2CVSS6.8AI score0.02693EPSS
SaveExploits1References3Affected Software1
Prion
Prion
•added 2015/01/21 3:28 p.m.•37 views

Design/Logic Flaw

Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE...

4CVSS6.1AI score0.67234EPSS
SaveExploits6References27Affected Software3
Prion
Prion
•added 2015/01/15 3:59 p.m.•37 views

Crlf injection

CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL...

4.3CVSS7.2AI score0.0681EPSS
SaveExploits0References24Affected Software3
Prion
Prion
•added 2014/11/30 1:59 a.m.•37 views

Race condition

Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service L1 guest OS crash via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842...

4.9CVSS6.5AI score0.00374EPSS
SaveExploits0References11Affected Software1
Prion
Prion
•added 2014/11/18 3:59 p.m.•37 views

Code injection

The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted 1 description field or 2 issuelink attribute in an XML file, which is not properly handled when executing the pregreplace function with the e modifier...

7.5CVSS7.6AI score0.50561EPSS
SaveExploits9References8Affected Software1
Prion
Prion
•added 2014/11/10 11:55 a.m.•37 views

Code injection

The sctpassoclookupasconfack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service panic via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter...

7.8CVSS6.8AI score0.08579EPSS
SaveExploits1References22Affected Software11
Prion
Prion
•added 2014/09/01 1:55 a.m.•37 views

Memory corruption

The kvmiommumappages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to 1 cause a denial of service host OS memory corruption or possibly have unspecified other impact by...

4.3CVSS7.7AI score0.01168EPSS
SaveExploits1References13Affected Software6
Prion
Prion
•added 2014/08/21 2:55 p.m.•37 views

Design/Logic Flaw

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

5.8CVSS6.7AI score0.09149EPSS
SaveExploits1References47Affected Software2
Prion
Prion
•added 2014/04/17 2:55 p.m.•37 views

Xxe

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML Extern...

6.8CVSS7.1AI score0.91354EPSS
SaveExploits2References5Affected Software1
Prion
Prion
•added 2014/03/25 1:25 p.m.•37 views

Design/Logic Flaw

The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack...

1.9CVSS6.4AI score0.00942EPSS
SaveExploits1References64Affected Software1
Prion
Prion
•added 2014/03/16 2:6 p.m.•37 views

Design/Logic Flaw

Use-after-free vulnerability in the WebSocketDispatcherHost::SendOrDrop function in content/browser/rendererhost/websocketdispatcherhost.cc in the Web Sockets implementation in Google Chrome before 33.0.1750.149 might allow remote attackers to bypass the sandbox protection mechanism by leveraging...

7.5CVSS6.6AI score0.01475EPSS
SaveExploits0References7Affected Software1
Prion
Prion
•added 2014/03/11 1:1 p.m.•37 views

Design/Logic Flaw

The dissectprotocoldataparameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does not properly allocate memory, which allows remote attackers to cause a denial of service application crash via a crafted SS7 MTP3 packet...

4.3CVSS6.8AI score0.02079EPSS
SaveExploits1References8Affected Software1
Prion
Prion
•added 2014/02/10 6:15 p.m.•37 views

Format string

The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library aka glibc 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string protection mechanism and cause a denial of service segmentati...

5CVSS6.5AI score0.02225EPSS
SaveExploits1References7Affected Software4
Prion
Prion
•added 2014/01/26 4:58 p.m.•37 views

Xxe

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External...

6.8CVSS9.2AI score0.90455EPSS
SaveExploits2References7Affected Software1
Prion
Prion
•added 2014/01/05 8:55 p.m.•37 views

Sql injection

Google Chrome before 21.0.1180.82 on iOS on iPad devices allows remote attackers to spoof the Omnibox URL via vectors involving SSL error messages, a related issue to CVE-2012-0674...

5CVSS6.3AI score0.01595EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2013/10/24 3:48 a.m.•37 views

Code injection

The kernel in Apple Mac OS X before 10.9 does not properly check for errors during the processing of multicast Wi-Fi packets, which allows remote attackers to cause a denial of service system crash by leveraging presence in an 802.11 network's coverage area...

5.7CVSS6.6AI score0.00615EPSS
SaveExploits0References1Affected Software1
Prion
Prion
•added 2013/07/08 8:55 p.m.•37 views

Server side request forgery (ssrf)

The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery SSRF issue, a similar vulnerability to CVE-2013-0235...

4.3CVSS7.3AI score0.28857EPSS
SaveExploits3References4Affected Software1
Prion
Prion
•added 2013/06/16 5:55 p.m.•37 views

Default configuration

The Data Camouflage aka FairCom Standard Encryption algorithm in FairCom c-treeACE does not ensure that a decryption key is needed for accessing database contents, which allows context-dependent attackers to read cleartext database records by copying a database to another system that has a certai...

7.1CVSS6.9AI score0.00691EPSS
SaveExploits0References1
Prion
Prion
•added 2013/04/17 12:19 p.m.•37 views

Design/Logic Flaw

Unspecified vulnerability in Oracle MySQL 5.1.63 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Types...

3.5CVSS5.6AI score0.01824EPSS
SaveExploits0References5Affected Software6
Prion
Prion
•added 2013/02/24 10:55 p.m.•37 views

Open redirect

Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified...

5.8CVSS6.9AI score0.01832EPSS
SaveExploits0References5Affected Software1
Prion
Prion
•added 2013/02/24 8:55 p.m.•37 views

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in jforum.page in JForum 2.1.9 allow remote attackers to inject arbitrary web script or HTML via the 1 action, 2 matchtype, 3 sortby, or 4 start parameters...

4.3CVSS6AI score0.02519EPSS
SaveExploits2References1Affected Software1
Prion
Prion
•added 2013/02/08 7:55 p.m.•37 views

Design/Logic Flaw

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct...

2.6CVSS7.4AI score0.35584EPSS
SaveExploits1References55Affected Software3
Total number of security vulnerabilities5000