Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,842

Export CSV
CVE-2020-24331

trousers: tss user still has read and write access to the /etc/tcsd.conf file if tcsd is started as root

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Trousers Project
Products
Fedora Enterprise Linux Trousers
CVE-2020-24330

trousers: fails to drop the root gid privilege when no longer needed

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid privilege when no longer needed.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Trousers Project
Products
Fedora Enterprise Linux Trousers
CVE-2020-23903

speex: divide by zero in read_samples() via crafted WAV file

A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file.

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Fedoraproject Redhat Xiph
Products
Fedora Enterprise Linux Speex
CVE-2020-1983

libslirp: use after free vulnerability cause a denial of service.

A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 6 more
CVE-2020-1945

ant: insecure temporary file vulnerability

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

CVSS 3.1 · 6.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Apache Canonical Fedoraproject and 3 more
Products
Ant Ubuntu Linux Fedora and 51 more
CVE-2020-1927

httpd: mod_rewrite configurations vulnerable to open redirect

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

CVSS 3.1 · 6.1 Medium EPSS 56.7% KEV · Not listed
Vendors
Apache Broadcom Canonical and 6 more
Products
Http Server Brocade Fabric Operating System Ubuntu Linux and 14 more
CVE-2020-1760

ceph: header-splitting in RGW GetObject has a possible XSS

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.

CVSS 3.1 · 5.8 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2020-1759

ceph: secure mode of msgr2 breaks both confidentiality and integrity aspects for long-lived sessions

A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks.

CVSS 3.1 · 6.4 Medium EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Linuxfoundation Redhat
Products
Fedora Ceph Ceph Storage and 2 more
CVE-2020-1753

Ansible: kubectl connection plugin leaks sensitive information

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux Fedora Ansible Engine and 1 more
CVE-2020-1747

PyYAML: arbitrary command execution through python/object/new when FullLoader is used

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

CVSS 3.1 · 9.8 Critical EPSS 5.4% KEV · Not listed
Vendors
Fedoraproject Opensuse Oracle and 2 more
Products
Fedora Leap Communications Cloud Native Core Network Function Cloud Native Environment and 2 more
CVE-2020-1740

ansible: secrets readable after ansible-vault edit

A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux Fedora Ansible and 4 more
CVE-2020-1739

ansible: svn module leaks password when specified as a parameter

A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux Fedora Ansible and 4 more
CVE-2020-1736

ansible: atomic_move primitive sets permissive permissions

A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Ansible Ansible Engine and 3 more
CVE-2020-1735

ansible: path injection on dest parameter in fetch module

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux Fedora Ansible and 4 more
CVE-2020-1733

ansible: insecure temporary directory when running become_user from become directive

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux Fedora Ansible and 4 more
CVE-2020-1730

libssh: denial of service when handling AES-CTR (or DES) ciphers

A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the connection hasn't been fully initialized and the system tries to cleanup the ciphers when closing the connection. The biggest threat from this vulnerability is system availability.

CVSS 3.1 · 5.3 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Fedoraproject Libssh and 3 more
Products
Ubuntu Linux Fedora Libssh and 4 more
CVE-2020-1695

resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Jboss Data Grid and 6 more
CVE-2020-18032

graphviz: off-by-one in parse_reclbl() in lib/common/shapes.c

Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted file into the "lib/common/shapes.c" component.

CVSS 3.1 · 7.8 High EPSS 2.6% KEV · Not listed
Vendors
Debian Fedoraproject Graphviz and 1 more
Products
Debian Linux Fedora Graphviz and 1 more
CVE-2020-17507

qt: buffer over-read in read_xbm_body in gui/image/qxbmhandler.cpp

An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in gui/image/qxbmhandler.cpp has a buffer over-read.

CVSS 3.1 · 5.3 Medium EPSS 4.0% KEV · Not listed
Vendors
Debian Fedoraproject Qt and 1 more
Products
Debian Linux Fedora Qt and 1 more