Show filters
3,830 Total Results
Displaying 11-20 of 3,830
Sort by:
Attacker Value
Moderate
CVE-2019-17571
Disclosure Date: December 20, 2019 (last updated November 08, 2023)
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
4
Attacker Value
High
CVE-2019-5021
Disclosure Date: May 08, 2019 (last updated November 27, 2024)
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user.
0
Attacker Value
Unknown
CVE-2020-16009
Disclosure Date: November 03, 2020 (last updated November 08, 2023)
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
3
Attacker Value
Unknown
CVE-2020-11022
Disclosure Date: April 29, 2020 (last updated November 08, 2023)
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
4
Attacker Value
Very High
Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium
Disclosure Date: October 10, 2019 (last updated October 06, 2023)
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
1
Attacker Value
Very High
CVE-2020-16846 — SaltStack Unauthenticated Shell Injection
Disclosure Date: November 06, 2020 (last updated February 07, 2025)
An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.
1
Attacker Value
Unknown
CVE-2015-4902
Disclosure Date: October 22, 2015 (last updated July 25, 2024)
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.
2
Attacker Value
Unknown
CVE-2015-4495
Disclosure Date: August 08, 2015 (last updated October 23, 2024)
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
2
Attacker Value
Unknown
CVE-2015-2590
Disclosure Date: July 16, 2015 (last updated July 17, 2024)
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.
2
Attacker Value
Unknown
CVE-2015-5123
Disclosure Date: July 14, 2015 (last updated July 03, 2024)
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
2
