Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.5The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functEPSS 2.7%Apr 8, 2018
- Critical9.8A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loadiEPSS 3.0%Feb 19, 2018
- High7.5parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.EPSS 6.5%Nov 23, 2017
- Critical9.8parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTEPSS 4.6%Nov 23, 2017
- High7.8A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process.EPSS 2.3%Jun 14, 2017
- High7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c.EPSS 4.6%May 18, 2017
- High7.5libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow.EPSS 4.8%May 18, 2017
- High8.8Google Chromium V8 Out-of-Bounds Read VulnerabilityKEVEPSS 48.1%Mar 29, 2016
- Medium5.9Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key ExcEPSS 2.9%Jan 9, 2016
- Critical10.0Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.EPSS 7.1%Jul 16, 2015
- Medium5.0The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of…EPSS 13.9%Jun 7, 2015
- Low1.9cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.EPSS 2.9%Feb 19, 2015
- Medium4.3The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgEPSS 98.7%Jan 9, 2015
- High7.5run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.EPSS 2.8%Jan 6, 2015
114 records · page 5 of 5
PreviousNext