CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Adobe Flash Player ASLR Bypass via Memory Address Disclosure (CVE-2015-0310)
[Affected Scope] Adobe Flash Player on Windows, OS X, and Linux within specific version ranges prior to January 2015 patches
[Impact] Attackers can bypass the Address Space Layout Randomization (ASLR) protection mechanism, significantly increasing the success rate of subsequent Remote Code Execution (RCE) attacks
[Mitigation] Immediately uninstall Adobe Flash Player or upgrade to the patched versions, and disable Flash execution in all web browsers
Microsoft Windows TS WebProxy Directory Traversal Privilege Escalation and IE Sandbox Escape (CVE-2015-0016, MS15-004)
[Affected Scope] Windows Vista SP2, 7 SP1, 8, 8.1, Windows Server 2008 R2 SP1, 2012 R2 utilizing the TS WebProxy (TSWbPrxy) component
[Impact] Remote attackers can bypass the Internet Explorer Protected Mode sandbox (Low Integrity) and execute arbitrary code with Medium Integrity privileges via a crafted executable path
[Mitigation] Apply the official Microsoft MS15-004 security update immediately and restrict unauthorized ActiveX control execution
Adobe Flash Player and AIR Invalid Pointer Dereference Remote Code Execution (CVE-2014-8439)
[Affected Scope] Adobe Flash Player before 13.0.0.258, 14.x/15.x before 15.0.0.239 (Windows/macOS), before 11.2.202.424 (Linux), and AIR/SDK before 15.0.0.293/302
[Impact] Attackers can execute arbitrary code or trigger a Denial of Service (DoS) via memory corruption on the target system
[Mitigation] Immediately uninstall legacy Adobe Flash Player components or restrict execution via browser policies and upgrade AIR SDK to secure versions
Microsoft Windows and Office IME (Japanese) Elevation of Privilege and Sandbox Escape (CVE-2014-4077)
[Affected Scope] Windows Server 2003/2008, Windows Vista, Windows 7, and Office 2007 environments with the Japanese Input Method Editor (IME) component IMJPDCT.EXE installed
[Impact] Remote attackers can bypass sandbox protection mechanisms via crafted PDF documents, escalating privileges to execute arbitrary code on the host system
[Mitigation] Apply the official Microsoft security update (MS14-078) or restrict execution permissions on the IMJPDCT.EXE binary
Microsoft Windows win32k.sys TrueType Font Parsing Remote Code Execution Vulnerability (CVE-2014-4148, MS14-058)
[Affected Scope] Windows Server 2003/2008/2012, Windows Vista, Windows 7, Windows 8/8.1, and Windows RT systems.
[Impact] Remote attackers can execute arbitrary code with kernel-mode privileges and gain full system control by enticing users to render specially crafted TrueType fonts.
[Mitigation] Apply the official Microsoft security update (MS14-058) immediately, or implement workarounds to block untrusted font rendering.
Microsoft Internet Explorer Elevation of Privilege Vulnerability (CVE-2014-4123, MS14-056)
[Affected Scope] Microsoft Internet Explorer versions 7 through 11 running on Windows environments.
[Impact] Remote attackers can bypass browser sandbox restrictions, elevate privileges, and execute arbitrary code on the host system via crafted web content.
[Mitigation] Apply the MS14-056 cumulative security update immediately, or transition to modern browsers and disable legacy Internet Explorer components.
CVE-2014-6278 Technical Vulnerability Analysis & Patch Advisory (CVSS 8.8)
[Affected Scope] Systems running unpatched versions impacted by CVE-2014-6278
[Impact] GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote att...
[Mitigation] Apply vendor security patches and restrict external network exposure.
Qualcomm MSM Audio Driver Stack-Based Buffer Overflow (CVE-2013-2597) Technical Advisory
[Affected Scope] Android devices powered by Qualcomm MSM chipsets running Linux kernel versions 2.6.x and 3.x
[Impact] Local attackers can exploit the /dev/msm_acdb device node to trigger a stack-based buffer overflow, leading to local privilege escalation (LPE) to root
[Mitigation] Apply official kernel patches from Qualcomm/Google, or restrict access permissions to the vulnerable /dev/msm_acdb device node
Microsoft Internet Explorer Elevation of Privilege Vulnerability (CVE-2014-2817, MS14-051)
[Affected Scope] Microsoft Internet Explorer versions 6 through 11
[Impact] Remote attackers can bypass sandbox restrictions and elevate privileges to execute arbitrary code in the context of the current user
[Mitigation] Apply the MS14-051 cumulative security update, disable Internet Explorer, and transition to modern secure browsers like Microsoft Edge
Adobe Reader and Acrobat Sandbox Escape and Remote Code Execution Vulnerability (CVE-2014-0546)
[Affected Scope] Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows operating systems.
[Impact] Attackers can bypass the sandbox protection mechanism and execute arbitrary native code in a privileged context.
[Mitigation] Immediately upgrade affected installations to patched versions 10.1.11, 11.0.08, or later.
Linux Kernel futex_requeue Local Privilege Escalation Vulnerability (CVE-2014-3153, Towelroot)
[Affected Scope] All Linux distributions and Android devices running Linux kernel versions up to and including 3.14.5
[Impact] A local unprivileged user can exploit this vulnerability to corrupt kernel memory and gain full root privileges on the target system
[Mitigation] Upgrade the Linux kernel to the latest patched version provided by your OS vendor and reboot the system
Linux Kernel n_tty_write Race Condition Local Privilege Escalation (CVE-2014-0196)
[Affected Scope] All Linux systems running Linux kernel versions up to and including 3.14.3
[Impact] Local attackers can exploit a race condition to corrupt kernel memory, leading to a denial of service (system crash) or full root privilege escalation
[Mitigation] Apply the latest kernel security updates provided by your OS vendor and reboot the system
Microsoft Windows XMLDOM ActiveX Control Information Disclosure Vulnerability (CVE-2013-7331)
[Affected Scope] Microsoft.XMLDOM ActiveX control and Internet Explorer on Microsoft Windows 8.1 and earlier
[Impact] Remote attackers can determine the existence of local pathnames, UNC shares, intranet hostnames, and IP addresses via error code analysis
[Mitigation] Apply the MS14-052 cumulative security update or restrict ActiveX execution in Internet Explorer
Adobe Flash Player and AIR Double Free Vulnerability Analysis and Mitigation Guide (CVE-2014-0502)
[Affected Scope] Adobe Flash Player on Windows, macOS, Linux, and Adobe AIR/SDK on Android and desktop environments prior to specific patched versions
[Impact] Remote attackers can execute arbitrary code (RCE) and gain full control of the target system via crafted Flash content
[Mitigation] Upgrade to the patched versions immediately, or completely uninstall and disable Adobe Flash Player across all enterprise endpoints
Adobe Flash Player Integer Underflow Remote Code Execution Vulnerability (CVE-2014-0497)
[Affected Scope] Adobe Flash Player before 11.7.700.261, 11.8.x through 12.0.x before 12.0.0.44 on Windows/macOS, and before 11.2.202.336 on Linux
[Impact] Remote attackers can execute arbitrary code and gain full control of the target system by enticing users to visit a website containing a specially crafted Flash (.swf) file
[Mitigation] Immediately uninstall legacy Adobe Flash Player or upgrade to patched versions, and disable Flash execution in all web browsers
Linux Kernel ARM Platform get_user/put_user Missing Address Validation Arbitrary Kernel Memory Read/Write and Privilege Escalation (CVE-2013-6282)
[Affected Scope] Linux kernel before version 3.5.5 running on v6k and v7 ARM platforms, including affected Android devices
[Impact] Local attackers can exploit missing address validation in get_user and put_user APIs to read or write arbitrary kernel memory, leading to full root privilege escalation
[Mitigation] Upgrade the Linux kernel to version 3.5.5 or higher, or apply the latest security patches provided by your OS/device vendor
Microsoft Internet Explorer ActiveX Control (icardie.dll) Out-of-Bounds Write Remote Code Execution Vulnerability (CVE-2013-3918)
[Affected Scope] Internet Explorer and the icardie.dll ActiveX control running on Windows XP, Vista, 7, 8, 8.1, and Windows Server 2003, 2008, 2012
[Impact] Remote attackers can execute arbitrary code or cause a denial of service (system crash) by enticing users to visit a specially crafted malicious web page
[Mitigation] Apply the official Microsoft MS13-090 security patch or configure the ActiveX Kill Bit for the icardie.dll control via the registry
Microsoft Silverlight Pointer Validation Information Disclosure Vulnerability (CVE-2013-3896, MS13-087)
[Affected Scope] Microsoft Silverlight 5 before version 5.1.20913.0
[Impact] Remote attackers can obtain sensitive information from process memory, potentially bypassing security mitigations like ASLR to facilitate subsequent code execution
[Mitigation] Upgrade Microsoft Silverlight to version 5.1.20913.0 or later, or completely disable/uninstall the Silverlight plugin
Microsoft Internet Explorer SetMouseCapture Use-After-Free Remote Code Execution Vulnerability (CVE-2013-3893)
[Affected Scope] Microsoft Internet Explorer versions 6 through 11
[Impact] Remote attackers can execute arbitrary code with the privileges of the active user via crafted JavaScript and ms-help: protocol handlers
[Mitigation] Apply the MS13-080 cumulative security update, or implement workarounds such as disabling hxds.dll loading
Microsoft Internet Explorer 8/9/10 Memory Corruption Remote Code Execution Vulnerability (CVE-2013-3163, MS13-055)
[Affected Scope] Microsoft Internet Explorer (IE) versions 8, 9, and 10 running on Windows environments.
[Impact] Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the current user or cause a denial of service (memory corruption) via a crafted malicious website.
[Mitigation] Apply the official Microsoft security update (MS13-055), transition to modern secure browsers, or implement temporary workarounds such as disabling Active Scripting.