Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,842

Export CSV
CVE-2019-0217

httpd: mod_auth_digest: access control bypass due to race condition

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

CVSS 3.1 · 7.5 High EPSS 16.4% KEV · Not listed
Vendors
Apache Canonical Debian and 5 more
Products
Http Server Ubuntu Linux Debian Linux and 13 more
CVE-2019-0215

httpd: mod_ssl: access control bypass when using per-location client certification authentication

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

CVSS 3.0 · 7.5 High EPSS 10.4% KEV · Not listed
Vendors
Apache Fedoraproject Redhat
Products
Http Server Fedora Enterprise Linux
CVE-2019-0197

httpd: mod_http2: possible crash on late upgrade

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

CVSS 3.1 · 4.2 Medium EPSS 8.3% KEV · Not listed
Vendors
Apache Canonical Fedoraproject and 3 more
Products
Http Server Ubuntu Linux Fedora and 9 more
CVE-2019-0160

edk2: Buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media

Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Opensuse Redhat and 1 more
Products
Fedora Leap Enterprise Linux and 5 more
CVE-2018-8786

freerdp: Integer truncation leading to heap-based buffer overflow in update_read_bitmap_update() function

FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 8.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2018-7262

ceph: Unauthenticated malformed HTTP requests handled by rgw_civetweb.cc:RGW::init_env() can lead to denial of service

In Ceph before 12.2.3 and 13.x through 13.0.1, the rgw_civetweb.cc RGWCivetWeb::init_env function in radosgw doesn't handle malformed HTTP headers properly, allowing for denial of service.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Ceph Ceph Storage
CVE-2018-5345

gcab: Extracting malformed .cab files causes stack smashing potentially leading to arbitrary code execution

A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file.

CVSS 3.0 · 7.8 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2018-20662

poppler: SIGABRT PDFDoc::setup class in PDFDoc.cc

In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2018-20097

exiv2: Segmentation fault in Exiv2::Internal::TiffParserWorker::findPrimaryGroups function

There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Debian Exiv2 Fedoraproject and 1 more
Products
Debian Linux Exiv2 Fedora and 4 more
CVE-2018-1113

setup: nologin listed in /etc/shells violates security expectations

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2018-1111

dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.

CVSS 3.0 · 7.5 High EPSS 97.9% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 8 more
CVE-2018-1099

etcd: DNS rebinding vulnerability in etcd server

DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Etcd
CVE-2018-1098

etcd: Cross-site request forgery via crafted local POST forms

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.

CVSS 3.0 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Etcd
CVE-2018-1090

pulp: sensitive credentials revealed through the API

In Pulp before version 2.16.2, secrets are passed into override_config when triggering a task and then become readable to all users with read access on the distributor/importer. An attacker with API access can then view these secrets.

CVSS 3.0 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Pulpproject Redhat
Products
Fedora Pulp Satellite and 1 more
CVE-2018-19872

qt: Malformed PPM image causing division by zero and crash in qppmhandler.cpp

An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp.

CVSS 3.0 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Opensuse Qt and 1 more
Products
Fedora Leap Qt and 1 more
CVE-2018-19841

wawpack: Out-of-bounds read in WavpackVerifySingleBlock function leads to DoS

The function WavpackVerifySingleBlock in open_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (out-of-bounds read and application crash) via a crafted WavPack Lossless Audio file, as demonstrated by wvunpack.

CVSS 3.1 · 5.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2018-19840

wawpack: Infinite loop in WavpackPackInit function lead to DoS

The function WavpackPackInit in pack_utils.c in libwavpack.a in WavPack through 5.1.0 allows attackers to cause a denial-of-service (resource exhaustion caused by an infinite loop) via a crafted wav audio file because WavpackSetConfiguration64 mishandles a sample rate of zero.

CVSS 3.0 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Fedoraproject Opensuse and 2 more
Products
Ubuntu Linux Fedora Leap and 2 more
CVE-2018-18311

perl: Integer overflow leading to buffer overflow in Perl_my_setenv()

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVSS 3.0 · 9.8 Critical EPSS 11.7% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Mac Os X Ubuntu Linux Debian Linux and 20 more
CVE-2018-17189

httpd: mod_http2: DoS via slow, unneeded request bodies

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

CVSS 3.1 · 5.3 Medium EPSS 19.4% KEV · Not listed
Vendors
Apache Canonical Debian and 4 more
Products
Http Server Ubuntu Linux Debian Linux and 11 more
CVE-2018-16886

etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS() via gRPC-gateway

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

CVSS 3.1 · 8.1 High EPSS 4.1% KEV · Not listed
Vendors
Etcd Fedoraproject Redhat
Products
Etcd Fedora Enterprise Linux Desktop and 3 more