CWE-17 · Other weaknesses
161CVEs
0exploited
0with a public check
11likely (EPSS 10%+)
SortMost likely exploited
161 CVEs with CWE-17 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2015-0240The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on…Samba · Samba · 2015-02-24 | – | 88% | 2015-02-24 |
| CVE-2014-9222AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to gain privileges via a crafted cookie that…Allegrosoft · Rompager · 2014-12-24 | – | 74% | 2014-12-24 |
| CVE-2015-4620name.c in named in ISC BIND 9.7.x through 9.9.x before 9.9.7-P1 and 9.10.x before 9.10.2-P2, when configured as a recursive resolver with DNSSEC validation, allows remote attacker…Isc · Bind · 2015-07-08 | – | 39% | 2015-07-08 |
| CVE-2014-9707EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting with a . (dot), which allows remote attackers to conduct directory traversal attacks, cause a…Embedthis · Goahead · 2015-03-31 | – | 28% | 2015-03-31 |
| CVE-2015-2526Microsoft .NET Framework 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to cause a denial of service to an ASP.NET web site via crafted requests, aka "MVC Denial of Service Vu…Microsoft · .net Framework · 2015-09-09 | – | 24% | 2015-09-09 |
| CVE-2015-0286The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-t…Openssl · Openssl · 2015-03-19 | – | 20% | 2015-03-19 |
| CVE-2015-1728Microsoft Windows Media Player 10 through 12 allows remote attackers to execute arbitrary code via a crafted DataObject on a web site, aka "Windows Media Player RCE via DataObject…Microsoft · Windows Media Player · 2015-06-10 | – | 18% | 2015-06-10 |
| CVE-2014-9296The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger…Ntp · Ntp · 2014-12-20 | – | 16% | 2014-12-20 |
| CVE-2015-3292The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to…Netapp · Oncommand Workflow Automation · 2015-05-31 | – | 12% | 2015-05-31 |
| CVE-2015-2535Active Directory in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service outage) by cre…Microsoft · Windows Server 2008 · 2015-09-09 | – | 12% | 2015-09-09 |
| CVE-2015-2682Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml.Citrix · Command Center · 2015-03-26 | – | 11% | 2015-03-26 |
| CVE-2015-4335Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.Redislabs · Redis · 2015-06-09 | – | 9.5% | 2015-06-09 |
| CVE-2015-0287The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE a…Openssl · Openssl · 2015-03-19 | – | 8.6% | 2015-03-19 |
| CVE-2015-0219Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) characte…Djangoproject · Django · 2015-01-16 | – | 7.0% | 2015-01-16 |
| CVE-2015-0290The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI support does not properly handle certain no…Openssl · Openssl · 2015-03-19 | – | 6.5% | 2015-03-19 |
| CVE-2015-1465The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence o…Linux · Linux Kernel · 2015-04-05 | – | 6.5% | 2015-04-05 |
| CVE-1999-0179Windows NT crashes or locks up when a Samba client executes a "cd .." command on a file share.Microsoft · Windows Nt · 1999-09-29 | – | 6.0% | 1999-09-29 |
| CVE-2013-7423The send_dg function in resolv/res_send.c in GNU C Library (aka glibc or libc6) before 2.20 does not properly reuse file descriptors, which allows remote attackers to send DNS que…Gnu · Glibc · 2015-02-24 | – | 5.8% | 2015-02-24 |
| CVE-2015-1157CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled…Apple · Itunes · 2015-05-28 | – | 5.6% | 2015-05-28 |
| CVE-2014-8121DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows…Gnu · Glibc · 2015-03-27 | – | 5.6% | 2015-03-27 |
| CVE-2015-8027Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a de…Nodejs · Node.js · 2016-01-02 | – | 5.4% | 2016-01-02 |
| CVE-2015-1233Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via uns…Google · Chrome · 2015-04-01 | – | 5.3% | 2015-04-01 |
| CVE-2015-2743PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers t…Mozilla · Firefox · 2015-07-06 | – | 4.7% | 2015-07-06 |
| CVE-2014-3500Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL.Apache · Cordova · 2014-11-15 | – | 4.1% | 2014-11-15 |
| CVE-2014-9143Open redirect vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via…Technicolor · Td5130 Router Firmware · 2014-12-05 | – | 4.0% | 2014-12-05 |
| CVE-2015-2736The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory…Mozilla · Firefox · 2015-07-06 | – | 3.7% | 2015-07-06 |
| CVE-2015-2735nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows…Mozilla · Firefox · 2015-07-06 | – | 3.7% | 2015-07-06 |
| CVE-2015-7196Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of service (incorrect garbage collection and…Mozilla · Firefox · 2015-11-05 | – | 3.7% | 2015-11-05 |
| CVE-2015-0817The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds check…Mozilla · Firefox · 2015-03-24 | – | 3.7% | 2015-03-24 |
| CVE-2013-2184Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.Sixapart · Movable Type · 2015-03-27 | – | 3.6% | 2015-03-27 |
| CVE-2015-1935The scalar-function implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote attackers to cause…Ibm · Db2 · 2015-07-20 | – | 3.5% | 2015-07-20 |
| CVE-2015-7204Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary code via crafted JavaScript variable assi…Mozilla · Firefox · 2015-12-16 | – | 3.5% | 2015-12-16 |
| CVE-2015-0806The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozi…Mozilla · Firefox · 2015-04-01 | – | 3.3% | 2015-04-01 |
| CVE-2015-0805The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClien…Mozilla · Firefox · 2015-04-01 | – | 3.3% | 2015-04-01 |
| CVE-2015-4963IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write to ar…Ibm · Security Access Manager For Web · 2015-11-08 | – | 3.3% | 2015-11-08 |
| CVE-2015-6496conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of s…Netfilter · Conntrack-Tools · 2015-08-24 | – | 3.2% | 2015-08-24 |
| CVE-2015-0847nbd-server.c in Network Block Device (nbd-server) before 3.11 does not properly handle signals, which allows remote attackers to cause a denial of service (deadlock) via unspecifi…Wouter Verhelst · Nbd · 2015-05-29 | – | 3.2% | 2015-05-29 |
| CVE-2015-7192The accessibility-tools feature in Mozilla Firefox before 42.0 on OS X improperly interacts with the implementation of the TABLE element, which allows remote attackers to cause a…Mozilla · Firefox · 2015-11-05 | – | 3.0% | 2015-11-05 |
| CVE-2015-2922The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote at…Linux · Linux Kernel · 2015-05-27 | – | 3.0% | 2015-05-27 |
| CVE-2015-1822chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial…Tuxfamily · Chrony · 2015-04-16 | – | 2.9% | 2015-04-16 |
| CVE-2015-3811epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 improperly refers to previously processed bytes, which allows remote…Wireshark · Wireshark · 2015-05-26 | – | 2.9% | 2015-05-26 |
| CVE-2015-8547The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the "/op…Quassel-Irc · Quassel · 2016-01-08 | – | 2.8% | 2016-01-08 |
| CVE-2016-10142An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all affected IPv6 implementations from all ven…Ietf · Ipv6 · 2017-01-14 | – | 2.8% | 2017-01-14 |
| CVE-2015-6735The reset functionality in the TimedMediaHandler extension for MediaWiki does not create a new transcode, which allows remote attackers to cause a denial of service (transcode del…Timedmediahandler Project · Timedmediahandler · 2015-09-01 | – | 2.7% | 2015-09-01 |
| CVE-2014-6386Juniper Junos 11.4 before 11.4R8, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.1X47 before 12.1X47-D10, 12.2 before 12.2R9, 12.3R2 before…Juniper · Junos · 2015-01-16 | – | 2.7% | 2015-01-16 |
| CVE-2015-0222ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by sub…Djangoproject · Django · 2015-01-16 | – | 2.7% | 2015-01-16 |
| CVE-2013-7424The getaddrinfo function in glibc before 2.15, when compiled with libidn and the AI_IDN flag is used, allows context-dependent attackers to cause a denial of service (invalid free…Gnu · Glibc · 2015-08-26 | – | 2.7% | 2015-08-26 |
| CVE-2015-1463ClamAV before 0.98.6 allows remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an "incorrect compiler optimization."Clamav · Clamav · 2015-02-03 | – | 2.7% | 2015-02-03 |
| CVE-2015-6736The Quiz extension for MediaWiki allows remote attackers to cause a denial of service via regex metacharacters in a regular expression.Quiz Project · Quiz · 2015-09-01 | – | 2.7% | 2015-09-01 |
| CVE-2015-2738The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thu…Mozilla · Firefox · 2015-07-06 | – | 2.7% | 2015-07-06 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.