Lucene search
+L
PrionMost viewed

213680 matches found

Prion
Prion
•added 2018/02/28 8:29 p.m.•37 views

Code injection

The URL pattern of "" the empty string which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It...

4.3CVSS7.7AI score0.17378EPSS
SaveExploits0References40Affected Software10
Prion
Prion
•added 2018/01/10 1:29 a.m.•37 views

Denial of service

Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from...

5CVSS7.3AI score0.08885EPSS
SaveExploits0References4Affected Software3
Prion
Prion
•added 2017/12/11 9:29 p.m.•37 views

Denial of service

The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic...

6.1CVSS7AI score0.01216EPSS
SaveExploits0References17Affected Software10
Prion
Prion
•added 2017/12/11 3:29 p.m.•37 views

Remote code execution

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

7.5CVSS9.8AI score0.17741EPSS
SaveExploits1References6Affected Software3
Prion
Prion
•added 2017/12/05 9:29 a.m.•37 views

Design/Logic Flaw

The dccpdisconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial of service use-after-free via an AFUNSPEC connect system call during the DCCPLISTEN state...

7.2CVSS6AI score0.01344EPSS
SaveExploits5References24Affected Software1
Prion
Prion
•added 2017/11/27 7:29 p.m.•37 views

Information disclosure

The walkhugetlbrange function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore system call...

2.1CVSS5.5AI score0.02084EPSS
SaveExploits8References13Affected Software1
Prion
Prion
•added 2017/11/20 3:29 p.m.•37 views

Design/Logic Flaw

In the addmatch function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code...

6.5CVSS8.5AI score0.0624EPSS
SaveExploits12References20Affected Software4
Prion
Prion
•added 2017/11/17 7:29 p.m.•37 views

Code injection

On BIG-IP versions 11.6.0-11.6.2 fixed in 11.6.2 HF1, 12.0.0-12.1.2 HF1 fixed in 12.1.2 HF2, or 13.0.0-13.0.0 HF2 fixed in 13.0.0 HF3 a virtual server configured with a Client SSL profile may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA, which when...

4.3CVSS7.2AI score0.19553EPSS
SaveExploits1References5Affected Software9
Prion
Prion
•added 2017/11/17 5:29 a.m.•37 views

Integer overflow

CPython aka Python up to 2.7.13 is vulnerable to an integer overflow in the PyStringDecodeEscape function in stringobject.c, resulting in heap-based buffer overflow and possible arbitrary code execution...

7.5CVSS9.5AI score0.08228EPSS
SaveExploits0References9Affected Software2
Prion
Prion
•added 2017/11/15 3:29 a.m.•37 views

Memory corruption

ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique fr...

7.6CVSS7.3AI score0.69802EPSS
SaveExploits25References4
Prion
Prion
•added 2017/10/03 1:29 a.m.•37 views

Information disclosure

dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests...

4.3CVSS7.1AI score0.67549EPSS
SaveExploits5References20Affected Software7
Prion
Prion
•added 2017/08/24 8:29 p.m.•37 views

Code injection

Array index error in the scanstring function in the json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the rawdecode function...

4.3CVSS6.7AI score0.08125EPSS
SaveExploits1References9Affected Software3
Prion
Prion
•added 2017/08/23 2:29 p.m.•37 views

Cross site scripting

DOM based Cross-site scripting XSS vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript...

4.3CVSS6.1AI score0.01192EPSS
SaveExploits1References3Affected Software1
Prion
Prion
•added 2017/08/09 4:29 p.m.•37 views

Design/Logic Flaw

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not , which might allow remote attackers to obtain the value of generated MD5...

5CVSS6.8AI score0.05292EPSS
SaveExploits0References14Affected Software12
Prion
Prion
•added 2017/06/19 4:29 p.m.•37 views

Design/Logic Flaw

The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMITSTACK/RLIMINFINITY 1/4 of the size, but does not take the argument and environment pointers into account, which allows attackers to bypass this limitation. This affects Linux Kernel version...

7.2CVSS7.3AI score0.00899EPSS
SaveExploits0References5Affected Software1
Prion
Prion
•added 2017/06/08 8:29 p.m.•37 views

Input validation

/ext/phar/pharobject.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833...

7.5CVSS8AI score0.07753EPSS
SaveExploits1References4Affected Software3
Prion
Prion
•added 2017/05/24 3:29 p.m.•37 views

Race condition

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in leftadjustcharhead during regular expression compilation. Invalid handling of reg-dmax in forwardsearchrange could result in an invalid pointer...

5CVSS6.9AI score0.05129EPSS
SaveExploits1References3Affected Software3
Prion
Prion
•added 2017/05/06 12:29 a.m.•37 views

Authentication flaw

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 ...

7.5CVSS9.6AI score0.99998EPSS
SaveExploits13References4
Prion
Prion
•added 2017/04/17 4:59 p.m.•37 views

Server side request forgery (ssrf)

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. Thi...

5CVSS7.4AI score0.1684EPSS
SaveExploits0References34Affected Software1
Prion
Prion
•added 2017/04/12 2:59 p.m.•37 views

Remote code execution

Microsoft .NET Framework 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allows an attacker with access to the local system to execute malicious code, aka ".NET Remote Code Execution Vulnerability."...

7.2CVSS7.6AI score0.17848EPSS
SaveExploits3References4Affected Software1
Prion
Prion
•added 2017/04/06 5:59 p.m.•37 views

Command injection

A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00AAQT.4b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such ...

9CVSS8.9AI score0.37634EPSS
SaveExploits5References1Affected Software1
Prion
Prion
•added 2017/03/30 11:59 p.m.•37 views

Design/Logic Flaw

The vmwgbsurfacedefineioctl function in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.10.7 does not validate certain levels data, which allows local users to cause a denial of service system hang via a crafted ioctl call for a /dev/dri/renderD device...

4.9CVSS4.9AI score0.00378EPSS
SaveExploits0References6Affected Software1
Prion
Prion
•added 2017/03/29 8:59 p.m.•37 views

Input validation

When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox...

7.5CVSS7.6AI score0.03169EPSS
SaveExploits1References7Affected Software1
Prion
Prion
•added 2017/03/27 2:59 a.m.•37 views

Buffer overflow

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services IIS 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: http://" in a PROPFIND request, as exploited in the wild ...

10CVSS9.6AI score0.99823EPSS
SaveExploits41References10Affected Software1
Prion
Prion
•added 2017/03/17 12:59 a.m.•37 views

Remote code execution

Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows guest OS users to execute arbitrary code on the host OS via a crafted application, aka "Hyper-V Remo...

7.4CVSS7.8AI score0.1267EPSS
SaveExploits0References3Affected Software3
Prion
Prion
•added 2017/01/24 9:59 p.m.•37 views

Integer overflow

The exifconvertanytoint function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service application crash via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1...

5CVSS7AI score0.07827EPSS
SaveExploits0References11Affected Software1
Prion
Prion
•added 2016/10/16 9:59 p.m.•37 views

Design/Logic Flaw

The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service stack consumption and panic or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a relat...

7.8CVSS8AI score0.07613EPSS
SaveExploits0References11Affected Software3
Prion
Prion
•added 2016/08/07 10:59 a.m.•37 views

Double free

Double free vulnerability in the phpmbregexeregreplaceexec function in phpmbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service application crash by leveraging a callback...

7.5CVSS8.3AI score0.0963EPSS
SaveExploits1References14Affected Software1
Prion
Prion
•added 2016/08/05 1:59 a.m.•37 views

Design/Logic Flaw

Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service heap memory corruption and application crash by leveraging keyboard access to use the Alt...

7.5CVSS8.1AI score0.02953EPSS
SaveExploits0References11Affected Software3
Prion
Prion
•added 2016/07/25 2:59 p.m.•37 views

Design/Logic Flaw

The phpurlparseex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a denial of service buffer over-read or possibly have unspecified other impact via vectors involving the smartstr data type...

7.5CVSS7.9AI score0.05055EPSS
SaveExploits0References9Affected Software1
Prion
Prion
•added 2016/07/21 10:14 a.m.•37 views

Design/Logic Flaw

Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR...

4CVSS6AI score0.03703EPSS
SaveExploits0References19Affected Software12
Prion
Prion
•added 2016/06/03 2:59 p.m.•37 views

Design/Logic Flaw

The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 6.0.16.25, 6 R1 before SR8 FP25 6.1.8.25, 7 before SR9 FP40 7.0.9.40, 7 R1 before SR3 FP40 7.1.3.40, and 8 before SR3 8.0.3.0 uses the invoke method of the java.lang.reflect.Method class in an...

6.8CVSS8.3AI score0.04382EPSS
SaveExploits0References22Affected Software13
Prion
Prion
•added 2016/05/16 10:59 a.m.•37 views

Null pointer dereference

The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation after the principal argument...

5CVSS7.3AI score0.07276EPSS
SaveExploits0References6Affected Software2
Prion
Prion
•added 2016/05/16 10:59 a.m.•37 views

Sql injection

ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152...

4.3CVSS6.8AI score0.07083EPSS
SaveExploits1References9Affected Software1
Prion
Prion
•added 2016/05/16 10:59 a.m.•37 views

Null pointer dereference

The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation during initial error checking,...

5CVSS7.3AI score0.07276EPSS
SaveExploits0References6Affected Software2
Prion
Prion
•added 2016/05/16 10:59 a.m.•37 views

Design/Logic Flaw

Use-after-free vulnerability in the splptrheapinsert function in ext/spl/splheap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation...

7.5CVSS8.1AI score0.05466EPSS
SaveExploits1References5Affected Software2
Prion
Prion
•added 2016/03/03 8:59 p.m.•37 views

Double free

Double free vulnerability in the dsaprivdecode function in crypto/dsa/dsaameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via a malformed DSA private key...

10CVSS9.7AI score0.26335EPSS
SaveExploits1References57Affected Software5
Prion
Prion
•added 2016/03/03 8:59 p.m.•37 views

Out-of-bounds

The doaproutch function in crypto/bio/bprint.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service out-of-bounds write or memory consumption or possibly have unspecified other...

10CVSS9.7AI score0.53655EPSS
SaveExploits1References27Affected Software1
Prion
Prion
•added 2015/12/02 1:59 a.m.•37 views

Buffer overflow

PCRE before 8.38 mishandles the /?J?'d'?'d'\gd/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service buffer overflow or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScri...

7.5CVSS7.6AI score0.03558EPSS
SaveExploits0References6Affected Software1
Prion
Prion
•added 2015/12/02 1:59 a.m.•37 views

Heap overflow

The pcreexec function in pcreexec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegE...

7.5CVSS7.9AI score0.04436EPSS
SaveExploits1References8Affected Software2
Prion
Prion
•added 2015/11/11 11:59 a.m.•37 views

Memory corruption

Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6078...

9.3CVSS7.8AI score0.19436EPSS
SaveExploits0References4Affected Software1
Prion
Prion
•added 2015/10/19 10:59 a.m.•37 views

Race condition

Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipcaddid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c...

6.9CVSS6.1AI score0.00412EPSS
SaveExploits1References26Affected Software1
Prion
Prion
•added 2015/08/26 7:59 p.m.•37 views

Information disclosure

The slirpsmb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service instantiation failure by creating /tmp/qemu-smb.- files before the program...

1.9CVSS6.3AI score0.00372EPSS
SaveExploits0References14Affected Software1
Prion
Prion
•added 2015/07/26 10:59 p.m.•37 views

Cross site request forgery (csrf)

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelistedips protection mechanism via a crafted request...

4.3CVSS6.9AI score0.44984EPSS
SaveExploits6References5Affected Software1
Prion
Prion
•added 2015/07/16 11:0 a.m.•37 views

Buffer overflow

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.1.0, 12.1.2.0, and 12.1.3.0 allows remote attackers to affect integrity via unknown vectors...

2.6CVSS6.3AI score0.01792EPSS
SaveExploits0References2Affected Software1
Prion
Prion
•added 2015/06/10 1:59 a.m.•37 views

Memory corruption

Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability."...

9.3CVSS8AI score0.35105EPSS
SaveExploits0References3Affected Software1
Prion
Prion
•added 2015/03/30 10:59 a.m.•37 views

Design/Logic Flaw

Use-after-free vulnerability in the zendsharedmemdup function in zendsharedalloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

7.5CVSS7.8AI score0.08646EPSS
SaveExploits1References13Affected Software5
Prion
Prion
•added 2015/03/24 5:59 p.m.•37 views

Xxe

XML external entity XXE vulnerability in the SVG to 1 PNG and 2 JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file...

6.4CVSS7AI score0.16564EPSS
SaveExploits1References11Affected Software3
Prion
Prion
•added 2015/02/25 11:59 a.m.•37 views

Design/Logic Flaw

Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 on Windows, when the Maintenance Service is not used, allow local users to gain privileges via a Trojan horse DLL in 1 the current working...

6.9CVSS7.1AI score0.00328EPSS
SaveExploits0References10Affected Software5
Prion
Prion
•added 2015/02/11 3:1 a.m.•37 views

Double free

Double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a crafted application, aka "Windows Cursor Object Double Free Vulnerability."...

7.2CVSS6.8AI score0.02693EPSS
SaveExploits1References3Affected Software1
Total number of security vulnerabilities5000