← Back

Facebook

facebook

127 CVEs • 32 products

Products (32)

Click to collapse
Toggle
Hhvm
hhvm
40 CVEs
Hermes
hermes
20 CVEs
Thrift
thrift
9 CVEs
Hiphop Virtual Machine
hiphop_virtual_machine
7 CVEs
Proxygen
proxygen
7 CVEs
React
react
6 CVEs
Facebook
facebook
4 CVEs
Zstandard
zstandard
4 CVEs
Folly
folly
3 CVEs
Fizz
fizz
3 CVEs
Photouploader
photouploader
2 CVEs
React Dev Utils
react-dev-utils
2 CVEs
Wangle
wangle
2 CVEs
Facebook For Woocommerce
facebook_for_woocommerce
2 CVEs
Mcrouter
mcrouter
2 CVEs
Instagram
instagram
2 CVEs
Parlai
parlai
2 CVEs
Facebook Messenger
facebook_messenger
1 CVE
Buck
buck
1 CVE
Nuclide
nuclide
1 CVE
Gameroom
gameroom
1 CVE
Mvfst
mvfst
1 CVE
React Native
react-native
1 CVE
Messenger
messenger
1 CVE
Redex
redex
1 CVE
Lexical
lexical
1 CVE
Netconsd
netconsd
1 CVE
Tac Plus
tac_plus
1 CVE
React Devtools
react-devtools
1 CVE
Katran
katran
1 CVE
Meta Spark Studio
meta_spark_studio
1 CVE
Below
below
1 CVE

CVEs (127)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-6228
1Facebook
1Hiphop Virtual Machine
May 6, 2026
Dec 28, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 allows remote attackers to cause a denial of service (application crash) or...Show more
Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted arguments to the chunk_split function.Show less
CVE-2014-5386
1Facebook
1Hiphop Virtual Machine
May 6, 2026
Dec 28, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defe...Show more
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initialization vector.Show less
CVE-2014-2209
1Facebook
1Hiphop Virtual Machine
May 6, 2026
Dec 28, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access re...Show more
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.Show less
CVE-2014-2208
1Facebook
1Hiphop Virtual Machine
May 6, 2026
Dec 28, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by ente...Show more
CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string.Show less
CVE-2014-6392
1Facebook
2Facebook
Facebook Messenger
May 6, 2026
Sep 15, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the Facebook app 14.0 and the Facebook Messenger app 10.0 for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improp...Show more
Cross-site scripting (XSS) vulnerability in the Facebook app 14.0 and the Facebook Messenger app 10.0 for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improperly handled during MIME sniffing of chat traffic. NOTE: the vendor disputes the significance of this report, because the user must accept an interstitial warning before the HTML file content is rendered, and because the HTML content's origin is a sandbox domainShow less
CVE-2008-5711
1Facebook
1Photouploader
Apr 23, 2026
Dec 24, 2008
N/A· v4
N/A· v3
9.3 HIGH· v2
Heap-based buffer overflow in the Facebook PhotoUploader ActiveX control 5.0.14.0 and earlier allows remote attackers to execute arbitrary code via a long FileMask property value.
CVE-2008-0660
2Aurigma
Facebook
3Facebook
Image Uploader Activex ControlPhotouploader
Apr 23, 2026
Feb 8, 2008
N/A· v4
N/A· v3
9.3 HIGH· v2
Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and ImageUploader5 5.0.10.0, as used by Facebook PhotoUploader 4.5.57.0, allow remot...Show more
Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and ImageUploader5 5.0.10.0, as used by Facebook PhotoUploader 4.5.57.0, allow remote attackers to execute arbitrary code via long (1) ExtractExif and (2) ExtractIptc properties.Show less