Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,250

Export CSV
CVE-2020-1763

libreswan: DoS attack via malicious IKEv1 informational exchange message

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Libreswan Redhat
Products
Libreswan Enterprise Linux Rhel E4s and 1 more
CVE-2020-1721

pki-core: KRA vulnerable to reflected XSS via the getPk12 page

A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Dogtagpki Redhat
Products
Dogtagpki Enterprise Linux Rhel Eus
CVE-2020-1720

postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

CVSS 3.1 · 3.1 Low EPSS 1.2% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Decision Manager Enterprise Linux and 5 more
CVE-2020-1711

QEMU: block: iscsi: OOB heap access via an unexpected response of iSCSI Server

An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.

CVSS 3.1 · 7.7 High EPSS 4.0% KEV · Not listed
Vendors
Debian Opensuse Qemu and 1 more
Products
Debian Linux Leap Qemu and 6 more
CVE-2020-17049

Kerberos KDC Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

CVSS 3.1 · 6.6 Medium EPSS 13.8% KEV · Not listed
Vendors
Microsoft Redhat Samba
Products
Windows Server 1903 Windows Server 1909 Windows Server 2004 and 10 more
CVE-2020-16166

kernel: information exposure in drivers/char/random.c and kernel/time/timer.c

The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to drivers/char/random.c and kernel/time/timer.c.

CVSS 3.1 · 3.7 Low EPSS 5.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2020-16044

Mozilla: Use-after-free write when handling a malicious COOKIE-ECHO SCTP chunk

Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Enterprise Linux Rhel Eus
CVE-2020-16042

chromium-browser: Uninitialized Use in V8

Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Enterprise Linux Rhel E4s and 1 more
CVE-2020-16012

Mozilla: Variable time processing of cross-origin images during drawImage calls

Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Google Mozilla Redhat
Products
Chrome Firefox Enterprise Linux and 2 more
CVE-2020-15969

chromium-browser: Use after free in WebRTC

Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Ipados Iphone Os Macos and 11 more
CVE-2020-15862

net-snmp: Improper Privilege Management in EXTEND MIB may lead to privileged commands execution

Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Net-snmp Netapp and 1 more
Products
Ubuntu Linux Net-snmp Cloud Backup and 8 more
CVE-2020-15811

squid: HTTP Request Splitting could result in cache poisoning

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.

CVSS 3.1 · 6.5 Medium EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2020-15810

squid: HTTP Request Smuggling could result in cache poisoning

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2020-15780

kernel: lockdown: bypass through ACPI write via acpi_configfs

An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.

CVSS 3.1 · 6.7 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Linux Opensuse and 1 more
Products
Ubuntu Linux Linux Kernel Leap and 3 more
CVE-2020-15707

GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.

CVSS 3.1 · 5.7 Medium EPSS 1.6% KEV · Not listed
Vendors
Canonical Debian Gnu and 5 more
Products
Ubuntu Linux Debian Linux Grub2 and 16 more
CVE-2020-15706

GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.

GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Gnu and 4 more
Products
Ubuntu Linux Debian Linux Grub2 and 15 more
CVE-2020-15705

GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.

CVSS 3.1 · 6.4 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Debian Gnu and 4 more
Products
Ubuntu Linux Debian Linux Grub2 and 15 more
CVE-2020-15683

Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4.

CVSS 3.1 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Debian Mozilla Opensuse and 1 more
Products
Debian Linux Firefox Firefox Esr and 5 more
CVE-2020-15678

Mozilla: When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free scenario

When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Debian Mozilla Opensuse and 1 more
Products
Debian Linux Firefox Firefox Esr and 5 more