Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2019-11324

python-urllib3: Certification mishandle when error should be thrown

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Canonical Python Redhat
Products
Ubuntu Linux Urllib3 Enterprise Linux and 1 more
CVE-2019-11281

RabbitMQ XSS attack

Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy management information.

CVSS 3.1 · 4.8 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Pivotal Software and 1 more
Products
Debian Linux Fedora Rabbitmq and 2 more
CVE-2019-11255

Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.

CVSS 3.1 · 4.8 Medium EPSS 2.0% KEV · Not listed
Vendors
Kubernetes Redhat
Products
External-provisioner External-resizer External-snapshotter and 2 more
CVE-2019-11254

Kubernetes API Server denial of service vulnerability from malicious YAML payloads

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift
CVE-2019-11252

Credential leakage when failing to mount

The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift
CVE-2019-11251

kubectl cp allows symlink directory traversal

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

CVSS 3.1 · 4.8 Medium EPSS 2.6% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift
CVE-2019-11250

Kubernetes client-go logs authorization headers at debug verbosity levels

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift Openshift Container Platform
CVE-2019-11249

kubectl cp allows symlink directory traversal

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.

CVSS 3.1 · 6.5 Medium EPSS 3.7% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift Openshift Container Platform
CVE-2019-11247

Kubernetes kube-apiserver allows access to custom resources via wrong scope

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.

CVSS 3.1 · 8.1 High EPSS 2.1% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift Openshift Container Platform
CVE-2019-11246

kubectl cp allows symlink directory traversal

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.12.9, versions prior to 1.13.6, versions prior to 1.14.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11.

CVSS 3.1 · 6.5 Medium EPSS 3.6% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift
CVE-2019-11244

kubectl creates world-writeable cached schema files

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Kubernetes Netapp Redhat
Products
Kubernetes Trident Openshift and 1 more
CVE-2019-11236

python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service

In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

CVSS 3.0 · 6.1 Medium EPSS 2.1% KEV · Not listed
Vendors
Python Redhat
Products
Urllib3 Ansible Tower Enterprise Linux and 1 more
CVE-2019-11235

freeradius: eap-pwd: authentication bypass via an invalid curve attack

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

CVSS 3.0 · 9.8 Critical EPSS 3.6% KEV · Not listed
Vendors
Canonical Fedoraproject Freeradius and 2 more
Products
Ubuntu Linux Fedora Freeradius and 7 more
CVE-2019-11190

kernel: ASLR bypass for setuid binaries due to late install_exec_creds()

The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Extras Rt
CVE-2019-11139

hw: voltage modulation technical advisory

Improper conditions check in the voltage modulation interface for some Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable denial of service via local access.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Intel Opensuse and 1 more
Products
Debian Linux Xeon 3104 Xeon 3104 Firmware and 114 more
CVE-2019-11085

kernel: insufficient input validation in kernel mode driver in Intel i915 graphics leads to privilege escalation

Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Intel Redhat
Products
I915 I915 Firmware Enterprise Linux and 6 more
CVE-2019-11070

webkitgtk: HTTP proxy setting deanonymization information disclosure

WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization. This issue was corrected by changing the way livestreams are downloaded.

CVSS 3.0 · 5.3 Medium EPSS 3.3% KEV · Not listed
Vendors
Redhat Webkitgtk Wpewebkit
Products
Enterprise Linux Webkitgtk Wpe Webkit
CVE-2019-11048

Temporary files are not cleaned after OOM when parsing HTTP request data

In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.

CVSS 3.1 · 5.3 Medium EPSS 6.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Software Collections
CVE-2019-11047

Heap-buffer-overflow READ in exif

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

CVSS 3.1 · 4.8 Medium EPSS 7.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more