56.784 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.784 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sort descending | Product and flaw | EPSS, sorted descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2002-0074 | HIGH 7.5 | microsoft internet_information_server Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session. | 33.8% | — |
| CVE-2020-16947 | HIGH 7.5 | microsoft 365_apps <p>A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the targeted user. I | 33.8% | — |
| CVE-2011-2013 | CRIT 9.8 | microsoft windows_7 Integer overflow in the TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code by sending a sequence of crafted UDP packets to a closed port, a | 33.7% | — |
| CVE-2016-0118 | HIGH 7.8 | microsoft windows_10 The PDF library in Microsoft Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka "Windows Remote Code Execution Vulnerability." | 33.7% | — |
| CVE-2010-1799 | HIGH 9.3 | apple quicktime Stack-based buffer overflow in the error-logging functionality in Apple QuickTime before 7.6.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file. | 33.7% | — |
| CVE-2016-1000031 | CRIT 9.8 | apache commons_fileupload Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution | 33.7% | — |
| CVE-2008-4128 | MED 4.3 | cisco ios Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /leve | 33.7% | |
| CVE-2018-13383 | MED 4.3 | ransomware fortinet fortios A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users d | 33.6% | |
| CVE-2002-0071 | HIGH 7.5 | microsoft internet_information_server Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names. | 33.6% | — |
| CVE-2004-0492 | HIGH 10.0 | apache http_server Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large a | 33.6% | — |
| CVE-2009-0235 | HIGH 9.3 | microsoft windows_2000 Stack-based buffer overflow in the Word 97 text converter in WordPad in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted Word 97 file that triggers memory corruption, relate | 33.6% | — |
| CVE-2002-1847 | HIGH 7.5 | microsoft windows_media_player Buffer overflow in mplay32.exe of Microsoft Windows Media Player (WMP) 6.3 through 7.1 allows remote attackers to execute arbitrary commands via a long mp3 filename command line argument. NOTE: since the only known attack vector requires command line access, t | 33.6% | — |
| CVE-2015-0071 | MED 6.5 | microsoft internet_explorer Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability." | 33.6% | |
| CVE-2016-3215 | MED 5.5 | microsoft edge Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 1511, and Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted PDF document, aka "Windows PDF Information Disclosure Vulnerability," a differe | 33.6% | — |
| CVE-2024-20290 | HIGH 7.5 | cisco secure_endpoint A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scan | 33.6% | — |
| CVE-2015-2444 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2442. | 33.6% | — |
| CVE-2013-3111 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013 | 33.5% | — |
| CVE-2009-0076 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 7, when XHTML strict mode is used, allows remote attackers to execute arbitrary code via the zoom style directive in conjunction with unspecified other directives in a malformed Cascading Style Sheets (CSS) stylesheet in a crafted H | 33.5% | — |
| CVE-2000-0711 | HIGH 7.5 | microsoft virtual_machine Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, which allows remote attackers to create a server on the victim's system via a malicious applet, as demonstrated by Brown Orifice. | 33.5% | — |
| CVE-2009-1385 | HIGH 7.8 | intel e1000 Integer underflow in the e1000_clean_rx_irq function in drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel before 2.6.30-rc8, the e1000e driver in the Linux kernel, and Intel Wired Ethernet (aka e1000) before 7.5.5 allows remote attackers t | 33.5% | — |
| CVE-2020-13921 | CRIT 9.8 | apache skywalking **Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases. | 33.5% | — |
| CVE-2022-24491 | CRIT 9.8 | microsoft windows_10 Windows Network File System Remote Code Execution Vulnerability | 33.5% | — |
| CVE-2011-4367 | MED 5.0 | apache myfaces Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.reso | 33.5% | — |
| CVE-2016-0971 | HIGH 8.8 | adobe air_desktop_runtime Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0. | 33.5% | — |
| CVE-2015-0050 | HIGH 9.3 | microsoft internet_explorer Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 | 33.5% | — |