CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,437
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product redhat:enterprise_linux_eus. Show all products

199 CVEs, showing 151 to 199PreviousPage 4 of 4
CVESeverityTitlePublished
CVE-2019-11043
Known exploited
High 8.7Underflow in PHP-FPM can lead to RCE
Assigned by php
Oct 28, 2019
CVE-2019-10086
Healthcare
High 7.3In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Ja…
Assigned by apache
Aug 20, 2019
CVE-2019-10160Critical 9.8A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which s…
Assigned by redhat
Jun 7, 2019
CVE-2019-0211
Known exploited
High 7.8In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scrip…
Assigned by apache
Apr 8, 2019
CVE-2019-9948Critical 9.1urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggerin…
Assigned by mitre
Mar 23, 2019
CVE-2019-9636Medium 5.3Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization.
Assigned by mitre
Mar 8, 2019
CVE-2019-6109Medium 6.8An issue was discovered in OpenSSH 7.9.
Assigned by mitre
Jan 31, 2019
CVE-2019-6111Medium 5.9An issue was discovered in OpenSSH 7.9.
Assigned by mitre
Jan 31, 2019
CVE-2018-12121High 7.5Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB…
Assigned by nodejs
Nov 28, 2018
CVE-2017-12617
Known exploited
High 8.1When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.
Assigned by apache
Oct 3, 2017
CVE-2017-12615
Known exploited
High 8.1When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.
Assigned by apache
Sep 19, 2017
CVE-2016-6796High 7.5A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via…
Assigned by apache
Aug 11, 2017
CVE-2016-6797High 7.5The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global J…
Assigned by apache
Aug 10, 2017
CVE-2016-6794Medium 5.3When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager.
Assigned by apache
Aug 10, 2017
CVE-2016-5018Critical 9.1In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomca…
Assigned by apache
Aug 10, 2017
CVE-2016-0762Medium 5.9The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplie…
Assigned by apache
Aug 10, 2017
CVE-2016-9841Critical 9.8inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Assigned by microfocus
May 23, 2017
CVE-2016-9840High 8.8inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.
Assigned by microfocus
May 23, 2017
CVE-2017-8291
Known exploited
High 7.8Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an in…
Assigned by mitre
Apr 27, 2017
CVE-2016-5195
Known exploited
High 7.0Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-…
Assigned by Chrome
Nov 10, 2016
CVE-2016-3718
Known exploited
Medium 5.5The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
Assigned by redhat
May 5, 2016
CVE-2016-3715
Known exploited
Medium 5.5The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
Assigned by redhat
May 5, 2016
CVE-2016-3427
Known exploited
Critical 9.8Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vector…
Assigned by oracle
Apr 21, 2016
CVE-2016-1646
Known exploited
High 8.8The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to c…
Assigned by Chrome
Mar 29, 2016
CVE-2015-8126High 7.5Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x…
Assigned by mitre
Nov 13, 2015
CVE-2015-4902
Known exploited
Medium 5.3Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.
Assigned by oracle
Oct 21, 2015
CVE-2015-7645
Known exploited
High 7.8Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF f…
Assigned by adobe
Oct 15, 2015
CVE-2015-4495
Known exploited
High 8.8The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain p…
Assigned by mozilla
Aug 8, 2015
CVE-2015-2590
Known exploited
Critical 9.8Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors…
Assigned by oracle
Jul 16, 2015
CVE-2015-5119
Known exploited
High 7.8Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x t…
Assigned by adobe
Jul 8, 2015
CVE-2015-3113
Known exploited
High 7.8Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbi…
Assigned by adobe
Jun 23, 2015
CVE-2015-3043
Known exploited
High 7.8Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of servi…
Assigned by adobe
Apr 14, 2015
CVE-2014-7169
Known exploited
Critical 9.8GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or poss…
Assigned by mitre
Sep 25, 2014
CVE-2014-6271
Known exploited
Critical 9.8GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, a…
Assigned by debian
Sep 24, 2014
CVE-2014-0196
Known exploited
Medium 5.5The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial…
Assigned by redhat
May 7, 2014
CVE-2014-0502
Known exploited
High 8.8Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on…
Assigned by adobe
Feb 21, 2014
CVE-2014-0497
Known exploited
High 8.8Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute ar…
Assigned by adobe
Feb 5, 2014
CVE-2013-1690
Known exploited
High 8.8Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with pag…
Assigned by mozilla
Jun 26, 2013
CVE-2013-2729
Known exploited
High 8.8Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerabilit…
Assigned by adobe
May 16, 2013
CVE-2013-1675
Known exploited
Medium 6.5Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mP…
Assigned by mozilla
May 16, 2013
CVE-2013-0648
Known exploited
High 8.8Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and…
Assigned by adobe
Feb 27, 2013
CVE-2013-0643
Known exploited
High 8.8The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly rest…
Assigned by adobe
Feb 27, 2013
CVE-2013-0641
Known exploited
High 7.8Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in…
Assigned by adobe
Feb 14, 2013
CVE-2013-0640
Known exploited
High 7.8Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…
Assigned by adobe
Feb 14, 2013
CVE-2012-4681
Known exploited
Critical 9.8Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses S…
Assigned by mitre
Aug 28, 2012
CVE-2012-1723
Known exploited
Critical 9.8Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows r…
Assigned by oracle
Jun 16, 2012
CVE-2012-2034
Known exploited
High 7.5Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and be…
Assigned by adobe
Jun 9, 2012
CVE-2012-1823
Known exploited
Critical 9.8sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which al…
Assigned by certcc
May 11, 2012
CVE-2011-3389Medium 4.3The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode wi…
Assigned by mitre
Sep 6, 2011
PreviousPage 4 of 4

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.