Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,536

Export CSV
CVE-2019-9169

glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

CVSS 3.1 · 9.8 Critical EPSS 4.7% KEV · Not listed
Vendors
Canonical Gnu Mcafee and 2 more
Products
Ubuntu Linux Glibc Web Gateway and 4 more
CVE-2019-6110

openssh: Acceptance and display of arbitrary stderr allows for spoofing of scp client output

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

CVSS 3.1 · 6.8 Medium EPSS 24.9% KEV · Not listed
Vendors
Netapp Openbsd Siemens and 1 more
Products
Element Software Ontap Select Deploy Storage Automation Store and 6 more
CVE-2019-6109

openssh: Missing character encoding in progress display allows for spoofing of scp client output

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.

CVSS 3.1 · 6.8 Medium EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 25 more
CVE-2019-5443

curl: Windows OpenSSL engine code injection

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Haxx Microsoft Netapp and 1 more
Products
Curl Windows Oncommand Insight and 7 more
CVE-2019-5188

e2fsprogs: Out-of-bounds write in e2fsck/rehash.c

A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian E2fsprogs Project and 4 more
Products
Ubuntu Linux Debian Linux E2fsprogs and 7 more
CVE-2019-5094

e2fsprogs: Crafted ext4 partition leads to out-of-bounds write

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian E2fsprogs Project and 3 more
Products
Ubuntu Linux Debian Linux E2fsprogs and 5 more
CVE-2019-3863

libssh2: Integer overflow in user authenticate keyboard interactive allows out-of-bounds writes

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.

CVSS 3.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Debian Libssh2 Netapp and 2 more
Products
Debian Linux Libssh2 Ontap Select Deploy Administration Utility and 12 more
CVE-2019-3862

libssh2: Out-of-bounds memory comparison with specially crafted message channel request

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

CVSS 3.0 · 7.3 High EPSS 7.9% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 3 more
Products
Debian Linux Fedora Libssh2 and 4 more
CVE-2019-3861

libssh2: Out-of-bounds reads with specially crafted SSH packets

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

CVSS 3.0 · 5 Medium EPSS 5.1% KEV · Not listed
Vendors
Debian Libssh2 Netapp and 2 more
Products
Debian Linux Libssh2 Ontap Select Deploy Administration Utility and 3 more
CVE-2019-3860

libssh2: Out-of-bounds reads with specially crafted SFTP packets

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

CVSS 3.0 · 5 Medium EPSS 5.4% KEV · Not listed
Vendors
Debian Libssh2 Netapp and 1 more
Products
Debian Linux Libssh2 Ontap Select Deploy Administration Utility and 1 more
CVE-2019-3859

libssh2: Unchecked use of _libssh2_packet_require and _libssh2_packet_requirev resulting in out-of-bounds read

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

CVSS 3.1 · 9.1 Critical EPSS 6.3% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 2 more
Products
Debian Linux Fedora Libssh2 and 2 more
CVE-2019-3858

libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read

An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.

CVSS 3.0 · 5 Medium EPSS 6.4% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 3 more
Products
Debian Linux Fedora Libssh2 and 4 more
CVE-2019-3857

libssh2: Integer overflow in SSH packet processing channel resulting in out of bounds write

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 6.1% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 4 more
Products
Debian Linux Fedora Libssh2 and 14 more
CVE-2019-3856

libssh2: Integer overflow in keyboard interactive handling resulting in out of bounds write

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 6.1% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 4 more
Products
Debian Linux Fedora Libssh2 and 14 more
CVE-2019-3855

libssh2: Integer overflow in transport read resulting in out of bounds write

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 9.3% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 5 more
Products
Xcode Debian Linux Fedora and 15 more
CVE-2019-18276

bash: when effective UID is not equal to its real UID the saved UID is not dropped

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

CVSS 3.1 · 7.8 High EPSS 2.6% KEV · Not listed
Vendors
Gnu Netapp Oracle and 1 more
Products
Bash Hci Management Node Oncommand Unified Manager and 3 more
CVE-2019-17498

libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

CVSS 3.1 · 8.1 High EPSS 3.8% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 3 more
Products
Debian Linux Fedora Libssh2 and 10 more