Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (131 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-3516 6 Debian, Fedoraproject, Netapp and 3 more 10 Debian Linux, Fedora, Clustered Data Ontap and 7 more 2024-11-21 7.8 High
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.
CVE-2020-24977 7 Debian, Fedoraproject, Netapp and 4 more 20 Debian Linux, Fedora, Active Iq Unified Manager and 17 more 2024-11-21 6.5 Medium
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.
CVE-2019-5815 3 Debian, Redhat, Xmlsoft 3 Debian Linux, Rhel Extras, Libxslt 2024-11-21 7.5 High
Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.
CVE-2018-9251 3 Debian, Redhat, Xmlsoft 3 Debian Linux, Enterprise Linux, Libxml2 2024-11-21 N/A
The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035.
CVE-2018-14567 4 Canonical, Debian, Redhat and 1 more 5 Ubuntu Linux, Debian Linux, Ansible Tower and 2 more 2024-11-21 N/A
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
CVE-2017-7376 3 Debian, Google, Xmlsoft 3 Debian Linux, Android, Libxml2 2024-11-21 N/A
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
CVE-2017-18258 2 Redhat, Xmlsoft 4 Ansible Tower, Enterprise Linux, Jboss Core Services and 1 more 2024-11-21 N/A
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
CVE-2017-15412 4 Debian, Google, Redhat and 1 more 10 Debian Linux, Chrome, Ansible Tower and 7 more 2024-11-21 N/A
Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2016-9598 2 Redhat, Xmlsoft 2 Jboss Core Services, Libxml2 2024-11-21 6.5 Medium
libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.
CVE-2016-9597 6 Canonical, Debian, Hp and 3 more 7 Ubuntu Linux, Debian Linux, Icewall Federation Agent and 4 more 2024-11-21 N/A
It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a Denial of Service attack due to a Stack Overflow. This is a regression CVE for the same issue as CVE-2016-3705.
CVE-2016-9596 2 Redhat, Xmlsoft 2 Jboss Core Services, Libxml2 2024-11-21 6.5 Medium
libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.