CVE-2019-16905

openssh: an integer overflow in the private key parsing code for the XMSS key type

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed

Vendors

Netapp Openbsd Siemens

Products

Cloud Backup Steelstore Cloud Integrated Storage Openssh and 4 more

CVE-2019-16168

sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."

CVSS 3.1 · 6.5 Medium EPSS 4.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 6 more

Products

Ubuntu Linux Debian Linux Fedora and 18 more

CVE-2019-10160

python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

CVSS 3.1 · 9.8 Critical EPSS 5.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 13 more

CVE-2015-20107

python: mailcap: findmatch() function does not sanitize the second argument

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

CVSS 3.1 · 7.8 High EPSS 2.8% KEV · Not listed

Vendors

Fedoraproject Netapp Python and 1 more

Products

Fedora Active Iq Unified Manager Ontap Select Deploy Administration Utility and 4 more

CVE-2021-22555

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

CVSS 3.1 · 8.3 High EPSS 78.7% KEV · Listed

Vendors

Broadcom Linux Netapp and 1 more

Products

Fabric Operating System Linux Kernel Aff 500f and 40 more

CVE-2026-22061

CVE-2026-22061 Debug Log Information Disclosure Vulnerability in Trident

Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Netapp

Products

Trident

CVE-2023-2269

kernel: A possible deadlock in dm_get_inactive_table in dm- ioctl.c leads to dos

A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 11 more

CVE-2023-20900

open-vm-tools: SAML token signature bypass

A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

CVSS 3.1 · 7.1 High EPSS 1.5% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 4 more

Products

Debian Linux Fedora Linux Kernel and 9 more

CVE-2023-1838

kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend()

A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel H300s H410c and 6 more

CVE-2022-23437

Infinite loop within Apache XercesJ xml parser

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

CVSS 3.1 · 6.5 Medium EPSS 11.6% KEV · Not listed

Vendors

Apache Netapp Oracle and 1 more

Products

Xerces-j Active Iq Unified Manager Agile Engineering Data Management and 28 more

CVE-2022-22971

springframework: DoS with STOMP over WebSocket

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Netapp Oracle Redhat and 1 more

Products

Cloud Secure Agent Oncommand Insight Financial Services Crime And Compliance Management Studio and 3 more

CVE-2022-1619

Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim

Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution

CVSS 3.1 · 7.8 High EPSS 2.6% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 2 more

Products

Macos Debian Linux Fedora and 3 more

CVE-2022-0500

kernel: Linux ebpf logic vulnerability leads to critical memory read and write gaining root privileges

A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Netapp and 1 more

Products

Fedora Linux Kernel H300e and 18 more

CVE-2021-43975

kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c

In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Linux and 2 more

Products

Debian Linux Fedora Linux Kernel and 18 more

CVE-2021-43797

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

CVSS 3.1 · 6.5 Medium EPSS 2.9% KEV · Not listed

Vendors

Debian Netapp Netty and 3 more

Products

Debian Linux Oncommand Workflow Automation Snapcenter and 25 more

CVE-2021-41079

Apache Tomcat DoS with unexpected TLS packet

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS 7.2% KEV · Not listed

Vendors

Apache Debian Netapp and 1 more

Products

Tomcat Debian Linux Management Services For Element Software And Netapp Hci and 3 more

CVE-2021-3449

NULL pointer deref in signature_algorithms processing

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

CVSS 3.1 · 5.9 Medium EPSS 63.5% KEV · Not listed

Vendors

Checkpoint Debian Fedoraproject and 10 more

Products

Multi-domain Management Multi-domain Management Firmware Quantum Security Gateway and 169 more

CVE-2021-37137

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

CVSS 3.1 · 7.5 High EPSS 6.6% KEV · Not listed

Vendors

Debian Netapp Netty and 3 more

Products

Debian Linux Oncommand Insight Netty and 21 more

CVE-2021-37136

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

CVSS 3.1 · 7.5 High EPSS 5.9% KEV · Not listed

Vendors

Debian Netapp Netty and 3 more

Products

Debian Linux Oncommand Insight Netty and 28 more

CVE-2021-35517

Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

CVSS 3.1 · 7.5 High EPSS 10.6% KEV · Not listed

Vendors

Apache Netapp Oracle and 1 more

Products

Commons Compress Active Iq Unified Manager Oncommand Insight and 26 more