Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2019-5018

sqlite: Use-after-free in window function leading to remote code execution

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.

CVSS 3.1 · 8.1 High EPSS 6.7% KEV · Not listed
Vendors
Canonical Redhat Sqlite
Products
Ubuntu Linux Enterprise Linux Sqlite
CVE-2019-3863

libssh2: Integer overflow in user authenticate keyboard interactive allows out-of-bounds writes

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.

CVSS 3.0 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Debian Libssh2 Netapp and 2 more
Products
Debian Linux Libssh2 Ontap Select Deploy Administration Utility and 12 more
CVE-2019-3862

libssh2: Out-of-bounds memory comparison with specially crafted message channel request

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

CVSS 3.0 · 7.3 High EPSS 8.0% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 3 more
Products
Debian Linux Fedora Libssh2 and 4 more
CVE-2019-3861

libssh2: Out-of-bounds reads with specially crafted SSH packets

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

CVSS 3.0 · 5 Medium EPSS 5.2% KEV · Not listed
Vendors
Debian Libssh2 Netapp and 2 more
Products
Debian Linux Libssh2 Ontap Select Deploy Administration Utility and 3 more
CVE-2019-3858

libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read

An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

CVSS 3.0 · 5 Medium EPSS 6.5% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 3 more
Products
Debian Linux Fedora Libssh2 and 4 more
CVE-2019-3857

libssh2: Integer overflow in SSH packet processing channel resulting in out of bounds write

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 6.2% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 4 more
Products
Debian Linux Fedora Libssh2 and 14 more
CVE-2019-3856

libssh2: Integer overflow in keyboard interactive handling resulting in out of bounds write

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 6.2% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 4 more
Products
Debian Linux Fedora Libssh2 and 14 more
CVE-2019-3855

libssh2: Integer overflow in transport read resulting in out of bounds write

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 9.3% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 5 more
Products
Xcode Debian Linux Fedora and 15 more
CVE-2019-19126

glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2019-18348

python: CRLF injection via the host part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.

CVSS 3.1 · 5.4 Medium EPSS 3.5% KEV · Not listed
Vendors
Python Redhat
Products
Python Rhel Software Collections
CVE-2019-18276

bash: when effective UID is not equal to its real UID the saved UID is not dropped

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

CVSS 3.1 · 7.8 High EPSS 2.6% KEV · Not listed
Vendors
Gnu Netapp Oracle and 1 more
Products
Bash Hci Management Node Oncommand Unified Manager and 3 more
CVE-2019-18224

libidn2: heap-based buffer overflow in idn2_to_ascii_4i in lib/lookup.c

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Gnu Redhat
Products
Libidn2 Enterprise Linux
CVE-2019-17594

ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c

There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Invisible-island Opensuse Redhat
Products
Ncurses Leap Enterprise Linux
CVE-2019-17498

libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

CVSS 3.1 · 8.1 High EPSS 3.8% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 3 more
Products
Debian Linux Fedora Libssh2 and 10 more
CVE-2019-16168

sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."

CVSS 3.1 · 6.5 Medium EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2019-16056

python: email.utils.parseaddr wrongly parses email addresses

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

CVSS 3.1 · 5.3 Medium EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2019-15903

expat: heap-based buffer over-read via crafted XML input

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

CVSS 3.1 · 6.5 Medium EPSS 6.6% KEV · Not listed
Vendors
Libexpat Project Python Redhat
Products
Libexpat Python Enterprise Linux and 2 more
CVE-2019-15847

gcc: POWER9 "DARN" RNG intrinsic produces repeated output

The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Gnu Opensuse Redhat
Products
Gcc Leap Enterprise Linux and 1 more