Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 330

Export CSV
CVE-2016-0797

OpenSSL: BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption

Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.

CVSS 3.1 · 7.5 High EPSS 27.0% KEV · Not listed
Vendors
Canonical Debian Nodejs and 2 more
Products
Ubuntu Linux Debian Linux Node.js and 3 more
CVE-2016-8740

httpd: Incomplete handling of LimitRequestFields directive in mod_http2

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

CVSS 3.0 · 7.5 High EPSS 79.1% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Jboss Core Services Rhel Software Collections
CVE-2016-0705

OpenSSL: Double-free in DSA code

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

CVSS 3.0 · 9.8 Critical EPSS 26.3% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Android and 6 more
CVE-2016-0702

OpenSSL: Side channel attack on modular exponentiation

The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.

CVSS 3.1 · 5.1 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Nodejs and 2 more
Products
Ubuntu Linux Debian Linux Node.js and 3 more
CVE-2016-5420

curl: Re-using connection with wrong client cert

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

CVSS 3.0 · 7.5 High EPSS 15.4% KEV · Not listed
Vendors
Debian Haxx Opensuse and 1 more
Products
Debian Linux Libcurl Leap and 3 more
CVE-2015-3196

OpenSSL: Race condition handling PSK identify hint

ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.

CVSS 2.0 · 4.3 Medium EPSS 13.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2012-1148

expat: Memory leak in poolGrow

Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.

CVSS 3.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Apple Libexpat Project Redhat
Products
Mac Os X Libexpat Enterprise Linux and 1 more
CVE-2012-0876

expat: hash table collisions CPU usage DoS

The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.

CVSS 2.0 · 4.3 Medium EPSS 5.7% KEV · Not listed
Vendors
Canonical Debian Libexpat Project and 3 more
Products
Ubuntu Linux Debian Linux Libexpat and 12 more
CVE-2022-37436

Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting

Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.

CVSS 3.1 · 5.3 Medium EPSS 52.7% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Jboss Core Services
CVE-2022-36760

Apache HTTP Server: mod_proxy_ajp Possible request smuggling

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.

CVSS 3.1 · 9 Critical EPSS 1.9% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Jboss Core Services
CVE-2023-24021

modsecurity: lacking the complete content in FILES_TMP_CONTENT leads to web application firewall bypass

Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Debian Redhat Trustwave
Products
Debian Linux Jboss Core Services Modsecurity
CVE-2022-28331

Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function

On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Apache Microsoft Redhat
Products
Portable Runtime Windows Jboss Core Services and 1 more
CVE-2022-24963

Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions

Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Apache Redhat
Products
Portable Runtime Enterprise Linux Jboss Core Services and 1 more
CVE-2024-38474

Apache HTTP Server weakness with encoded question marks in backreferences

Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.

CVSS 3.1 · 8.1 High EPSS 2.5% KEV · Not listed
Vendors
Apache Netapp Redhat
Products
Http Server Clustered Data Ontap Enterprise Linux and 6 more
CVE-2022-25147

Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions

Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Apache Redhat
Products
Portable Runtime Utility Enterprise Linux Jboss Core Services and 4 more
CVE-2006-20001

Apache HTTP Server: mod_dav out of bounds read, or write of zero byte

A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.

CVSS 3.1 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Jboss Core Services
CVE-2023-28321

curl: IDN wildcard match may lead to Improper Cerificate Validation

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`.

CVSS 3.1 · 5.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Macos Debian Linux Fedora and 14 more
CVE-2023-28319

curl: use after free in SSH sha256 fingerprint check

A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Apple Haxx Netapp and 1 more
Products
Macos Curl Clustered Data Ontap and 10 more
CVE-2019-9513

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

CVSS 3.1 · 7.5 High EPSS 81.6% KEV · Not listed
Vendors
Apache Apple Canonical and 9 more
Products
Traffic Server Mac Os X Swiftnio and 22 more
CVE-2019-9514

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

CVSS 3.1 · 7.5 High EPSS 82.8% KEV · Not listed
Vendors
Apache Apple Canonical and 10 more
Products
Traffic Server Mac Os X Swiftnio and 41 more