Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,468

Export CSV
CVE-2021-41617

openssh: privilege escalation when AuthorizedKeysCommand or AuthorizedPrincipalsCommand are configured

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

CVSS 3.1 · 7.0 High EPSS 2.5% KEV · Not listed
Vendors
Fedoraproject Netapp Openbsd and 3 more
Products
Fedora Active Iq Unified Manager Aff 500f and 12 more
CVE-2021-38604

glibc: NULL pointer dereference in helper_thread() in mq_notify.c while handling NOTIFY_REMOVED messages

In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Gnu Oracle
Products
Fedora Glibc Communications Cloud Native Core Binding Support Function and 5 more
CVE-2021-37750

krb5: NULL pointer dereference in process_tgs_req() in kdc/do_tgs_req.c via a FAST inner body that lacks server field

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Fedoraproject Mit and 3 more
Products
Debian Linux Fedora Kerberos 5 and 3 more
CVE-2021-36087

libsepol: heap-based buffer overflow in ebitmap_match_any()

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Selinux Project
Products
Fedora Enterprise Linux Selinux
CVE-2021-33910

systemd: uncontrolled allocation on the stack in function unit_name_path_escape leads to crash

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.

CVSS 3.1 · 5.5 Medium EPSS 8.8% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 2 more
Products
Debian Linux Fedora Hci Management Node and 5 more
CVE-2021-33574

glibc: mq_notify does not handle separately allocated thread attributes

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Debian Fedoraproject Gnu and 2 more
Products
Debian Linux Fedora Glibc and 18 more
CVE-2021-33560

libgcrypt: mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Debian Fedoraproject Gnupg and 2 more
Products
Debian Linux Fedora Libgcrypt and 6 more
CVE-2021-28861

python: open redirection vulnerability in lib/http/server.py may lead to information disclosure

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Python Redhat
Products
Fedora Python Enterprise Linux and 1 more
CVE-2021-28363

python-urllib3: HTTPS proxy host name not validated when using default SSLContext

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Fedoraproject Oracle Python and 1 more
Products
Fedora Peoplesoft Enterprise Peopletools Urllib3 and 1 more
CVE-2021-28153

glib: g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION creates empty target for dangling symlink

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

CVSS 3.1 · 5.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 2 more
Products
Brocade Fabric Operating System Firmware Debian Linux Fedora and 2 more
CVE-2021-28041

openssh: double-free memory corruption may lead to arbitrary code execution

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

CVSS 3.1 · 7.1 High EPSS 3.5% KEV · Not listed
Vendors
Fedoraproject Netapp Openbsd and 1 more
Products
Fedora Cloud Backup Hci Compute Node and 8 more
CVE-2021-27645

glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c

The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Gnu and 1 more
Products
Debian Linux Fedora Glibc and 1 more
CVE-2021-27219

glib: integer overflow in g_bytes_new function on 64-bit platforms due to an implicit cast from 64 bits to 32 bits

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.

CVSS 3.1 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 3 more
Products
Brocade Fabric Operating System Firmware Debian Linux Fedora and 12 more
CVE-2021-27218

glib: integer overflow in g_byte_array_new_take function when called with a buffer of 4GB or more on a 64-bit platform

An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 3 more
Products
Brocade Fabric Operating System Firmware Debian Linux Fedora and 5 more
CVE-2021-23336

Web Cache Poisoning

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

CVSS 3.1 · 5.9 Medium EPSS 41.1% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 4 more
Products
Debian Linux Django Fedora and 11 more
CVE-2021-22947

curl: Server responses received before STARTTLS processed after TLS handshake

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

CVSS 3.1 · 5.9 Medium EPSS 3.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 6 more
Products
Macos Debian Linux Fedora and 34 more
CVE-2021-22946

curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

CVSS 3.1 · 7.5 High EPSS 4.5% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 6 more
Products
Macos Debian Linux Fedora and 37 more