CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Linux Kernel n_tty_write Race Condition Local Privilege Escalation (CVE-2014-0196)
[Affected Scope] All Linux systems running Linux kernel versions up to and including 3.14.3
[Impact] Local attackers can exploit a race condition to corrupt kernel memory, leading to a denial of service (system crash) or full root privilege escalation
[Mitigation] Apply the latest kernel security updates provided by your OS vendor and reboot the system
Adobe Flash Player and AIR Double Free Vulnerability Analysis and Mitigation Guide (CVE-2014-0502)
[Affected Scope] Adobe Flash Player on Windows, macOS, Linux, and Adobe AIR/SDK on Android and desktop environments prior to specific patched versions
[Impact] Remote attackers can execute arbitrary code (RCE) and gain full control of the target system via crafted Flash content
[Mitigation] Upgrade to the patched versions immediately, or completely uninstall and disable Adobe Flash Player across all enterprise endpoints
Adobe Flash Player Integer Underflow Remote Code Execution Vulnerability (CVE-2014-0497)
[Affected Scope] Adobe Flash Player before 11.7.700.261, 11.8.x through 12.0.x before 12.0.0.44 on Windows/macOS, and before 11.2.202.336 on Linux
[Impact] Remote attackers can execute arbitrary code and gain full control of the target system by enticing users to visit a website containing a specially crafted Flash (.swf) file
[Mitigation] Immediately uninstall legacy Adobe Flash Player or upgrade to patched versions, and disable Flash execution in all web browsers
Microsoft Internet Explorer ActiveX Control (icardie.dll) Out-of-Bounds Write Remote Code Execution Vulnerability (CVE-2013-3918)
[Affected Scope] Internet Explorer and the icardie.dll ActiveX control running on Windows XP, Vista, 7, 8, 8.1, and Windows Server 2003, 2008, 2012
[Impact] Remote attackers can execute arbitrary code or cause a denial of service (system crash) by enticing users to visit a specially crafted malicious web page
[Mitigation] Apply the official Microsoft MS13-090 security patch or configure the ActiveX Kill Bit for the icardie.dll control via the registry
Microsoft Internet Explorer SetMouseCapture Use-After-Free Remote Code Execution Vulnerability (CVE-2013-3893)
[Affected Scope] Microsoft Internet Explorer versions 6 through 11
[Impact] Remote attackers can execute arbitrary code with the privileges of the active user via crafted JavaScript and ms-help: protocol handlers
[Mitigation] Apply the MS13-080 cumulative security update, or implement workarounds such as disabling hxds.dll loading
Adobe Flash Player ExternalInterface ActionScript Remote Code Execution Vulnerability (CVE-2013-0648, CISA KEV)
[Affected Scope] Adobe Flash Player versions before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 11.2.202.273 on Linux
[Impact] Remote attackers can execute arbitrary code and gain full control of the target system by enticing users to load a specially crafted SWF file
[Mitigation] Immediately uninstall Adobe Flash Player from all endpoints and servers, or disable Flash execution within web browsers and document viewers
Adobe Flash Player Firefox Sandbox Bypass and Remote Code Execution Vulnerability (CVE-2013-0643, CISA KEV)
[Affected Scope] Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows/macOS, and before 11.2.202.273 on Linux (specifically within Firefox plugin environments)
[Impact] Remote attackers can bypass the Firefox browser sandbox and execute arbitrary code on the host system via crafted malicious SWF content
[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the recommended mitigation is to completely uninstall Flash Player from all endpoints
Microsoft Internet Explorer 6/7/8 CDwnBindInfo Use-After-Free Remote Code Execution Vulnerability (CVE-2012-4792)
[Affected Scope] Microsoft Internet Explorer versions 6, 7, and 8
[Impact] Remote attackers can execute arbitrary code with user privileges via a crafted malicious website
[Mitigation] Apply the official MS13-008 security update, transition to a modern browser, or apply EMET mitigations
Microsoft Office and VBA VBE6.dll Untrusted Search Path Vulnerability (CVE-2012-1854) Advisory
[Affected Scope] Microsoft Office 2003 SP3, 2007 SP2/SP3, 2010 Gold/SP1, and systems utilizing Visual Basic for Applications (VBA)
[Impact] Local attackers can execute arbitrary code and escalate privileges by tricking a user into opening a document in a directory containing a malicious DLL
[Mitigation] Apply the official Microsoft security update (MS12-046) and restrict insecure DLL loading via registry modifications
Microsoft Windows win32k.sys TrueType Font Parsing Engine Remote Code Execution Vulnerability (CVE-2011-3402, Duqu Exploited)
[Affected Scope] Windows XP, Vista, 7, and Windows Server 2003, 2008 kernel-mode drivers (win32k.sys)
[Impact] Remote code execution (RCE) with kernel-level privileges via crafted TrueType font data in Word documents or web pages
[Mitigation] Apply official MS11-087 security patches or implement the T2EMBED.DLL registry/ACL workaround
Linux Kernel RDS Protocol Privilege Escalation Vulnerability (CVE-2010-3904) Technical Analysis and Mitigation Guide
[Affected Scope] Linux kernel versions before 2.6.36 with the Reliable Datagram Sockets (RDS) protocol module enabled
[Impact] Local unprivileged users can exploit this vulnerability via crafted sendmsg and recvmsg system calls to gain full root privileges
[Mitigation] Upgrade the Linux kernel to a patched version, or disable the RDS kernel module by blacklisting it if not required
Microsoft Internet Explorer CSS Use-After-Free Remote Code Execution Vulnerability (CVE-2010-3962)
[Affected Scope] Microsoft Internet Explorer versions 6, 7, and 8
[Impact] Remote attackers can execute arbitrary code with the privileges of the active user via a specially crafted web page
[Mitigation] Apply official cumulative security updates (MS10-090 or later), transition to modern browsers, or implement temporary workarounds
Mozilla Firefox and Thunderbird Remote Code Execution Vulnerability (CVE-2010-3765) Security Advisory
[Affected Scope] Mozilla Firefox 3.5.x through 3.5.14, 3.6.x through 3.6.11, Thunderbird 3.0.x through 3.0.9, 3.1.x through 3.1.5, and SeaMonkey 2.0.x through 2.0.9 with JavaScript enabled
[Impact] Remote attackers can trigger memory corruption and execute arbitrary code with the privileges of the logged-in user by enticing them to visit a specially crafted webpage
[Mitigation] Immediately upgrade to patched versions (Firefox 3.5.15/3.6.12, Thunderbird 3.0.10/3.1.6, SeaMonkey 2.0.10 or later) or disable JavaScript as a temporary workaround
Microsoft Internet Explorer iepeers.dll Use-After-Free Remote Code Execution Vulnerability (CVE-2010-0806)
[Affected Scope] Microsoft Internet Explorer 6, 6 SP1, and 7.
[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by enticing them to visit a specially crafted webpage.
[Mitigation] Apply the official Microsoft security updates, or implement workarounds such as setting the ActiveX Kill-Bit for the affected CLSID.
Microsoft Internet Explorer Use-After-Free Remote Code Execution Vulnerability (CVE-2010-0249, Operation Aurora)
[Affected Scope] Microsoft Internet Explorer 6, 6 SP1, 7, and 8 running on Windows 2000, XP, Server 2003, Vista, Server 2008, and Windows 7
[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by enticing them to visit a specially crafted malicious webpage
[Mitigation] Apply the official Microsoft security update (KB979352) immediately, or implement temporary mitigations such as enabling DEP and disabling Active Scripting
Adobe Reader and Acrobat Heap-Based Buffer Overflow Vulnerability (CVE-2009-3459) Analysis and Mitigation Guide
[Affected Scope] Adobe Reader and Acrobat versions 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2
[Impact] Remote attackers can execute arbitrary code and compromise the host system by tricking a user into opening a specially crafted PDF file
[Mitigation] Immediately upgrade to the patched versions (7.1.4, 8.1.7, or 9.2 and above) and restrict opening untrusted PDF attachments
Microsoft DirectX DirectShow QuickTime Parser Remote Code Execution Vulnerability (CVE-2009-1537, KEV Listed)
[Affected Scope] DirectShow (quartz.dll) in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2/SP3, and Windows Server 2003 SP2
[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by tricking them into opening a specially crafted QuickTime media file
[Mitigation] Apply the official Microsoft security updates (MS09-028) or disable the QuickTime Movie Parser Filter via registry modification (Kill-bit)
Microsoft Excel Invalid Object Reference Remote Code Execution Vulnerability (CVE-2009-0238) Advisory
[Affected Scope] Microsoft Office Excel 2000 through 2007, Excel Viewer, Office for Mac 2004/2008, and Compatibility Pack.
[Impact] Opening a specially crafted Excel document can trigger an access attempt on an invalid object, allowing remote attackers to execute arbitrary code.
[Mitigation] Apply the official Microsoft security patches immediately and restrict opening untrusted Excel attachments.
Microsoft Windows Server Service Remote Code Execution Vulnerability (MS08-067, CVE-2008-4250)
[Affected Scope] Microsoft Windows 2000, XP, Server 2003, Vista, Server 2008, and Windows 7 Pre-Beta
[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM privileges and gain full control of the target system via crafted RPC requests
[Mitigation] Apply the official Microsoft security patch (MS08-067) immediately and restrict external access to SMB ports (TCP 139/445)
Microsoft Excel Remote Code Execution (RCE) Zero-Day Vulnerability (CVE-2007-0671)
[Affected Scope] Microsoft Excel 2000, XP, 2003, Excel 2004 for Mac, and potentially other legacy Office products
[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by tricking them into opening a specially crafted Excel file
[Mitigation] Apply official Microsoft security patches immediately, restrict opening untrusted Excel attachments, and enforce strict macro execution policies