Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2019-11042

heap-buffer-overflow on exif_process_user_comment in EXIF extension

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

CVSS 3.1 · 7.1 High EPSS 4.4% KEV · Not listed
Vendors
Apple Canonical Debian and 4 more
Products
Mac Os X Ubuntu Linux Debian Linux and 6 more
CVE-2019-11041

heap-buffer-overflow on exif_scan_thumbnail in EXIF extension

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

CVSS 3.1 · 7.1 High EPSS 4.4% KEV · Not listed
Vendors
Apple Canonical Debian and 4 more
Products
Mac Os X Ubuntu Linux Debian Linux and 6 more
CVE-2019-11040

Heap buffer overflow in EXIF extension

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

CVSS 3.1 · 9.1 Critical EPSS 4.1% KEV · Not listed
Vendors
Debian Opensuse Php and 1 more
Products
Debian Linux Leap Php and 3 more
CVE-2019-11039

Out-of-bounds read in iconv.c

Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

CVSS 3.1 · 9.1 Critical EPSS 3.1% KEV · Not listed
Vendors
Debian Opensuse Php and 1 more
Products
Debian Linux Leap Php and 3 more
CVE-2019-11038

Uninitialized read in gdImageCreateFromXbm

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

CVSS 3.1 · 5.3 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2019-11036

Heap over-read in PHP EXIF extension

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

CVSS 3.1 · 9.1 Critical EPSS 7.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2019-11035

Heap over-read in PHP EXIF extension

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.

CVSS 3.1 · 9.1 Critical EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Netapp and 3 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 5 more
CVE-2019-11034

Heap over-read in PHP EXIF extension

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

CVSS 3.1 · 9.1 Critical EPSS 4.1% KEV · Not listed
Vendors
Canonical Debian Netapp and 3 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 5 more
CVE-2019-10876

openstack-neutron: DOS via broken port range merging in security group

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Openstack Redhat
Products
Neutron Openstack
CVE-2019-10871

poppler: heap-based buffer over-read in function PSOutputDev::checkPageSlice in PSOutputDev.cc

An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Freedesktop Redhat
Products
Poppler Enterprise Linux
CVE-2019-10773

nodejs-yarn: Install functionality can be abused to generate arbitrary symlinks

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed
Vendors
Redhat Yarnpkg
Products
Quay Yarn
CVE-2019-10747

nodejs-set-value: prototype pollution in function set-value

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Redhat Set-value Project
Products
Enterprise Linux Rhel Software Collections Set-value
CVE-2019-10746

nodejs-mixin-deep: prototype pollution in function mixin-deep

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Mixin-deep Project Oracle and 1 more
Products
Fedora Mixin-deep Communications Cloud Native Core Network Function Cloud Native Environment and 2 more
CVE-2019-10744

nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

CVSS 3.1 · 9.1 Critical EPSS 5.0% KEV · Not listed
Vendors
F5 Lodash Netapp and 2 more
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 23 more
CVE-2019-10650

ImageMagick: heap-based buffer over-read in WriteTIFFImage of coders/tiff.c leads to denial of service or information disclosure via crafted image file

In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a crafted image file.

CVSS 3.0 · 8.1 High EPSS 4.1% KEV · Not listed
Vendors
Debian Imagemagick Redhat
Products
Debian Linux Imagemagick Enterprise Linux
CVE-2019-10639

Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR

The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to have a dependency on an address associated with a network namespace.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus and 1 more
CVE-2019-10638

Kernel: net: weak IP ID generation leads to remote device tracking

In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses.

CVSS 3.0 · 6.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Extras Rt
CVE-2019-10432

jenkins-2-plugins: Stored XSS vulnerability in HTML Publisher Plugin

Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those.

CVSS 3.1 · 5.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Jenkins Redhat
Products
Html Publisher Openshift
CVE-2019-10431

jenkins-script-security: Sandbox bypass vulnerability in Script Security Plugin

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.

CVSS 3.1 · 9.9 Critical EPSS 2.8% KEV · Not listed
Vendors
Jenkins Redhat
Products
Script Security Openshift