Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,088

Export CSV
CVE-2007-2028

security flaw

Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUE_PAIR data structures.

CVSS 2.0 · 5.0 Medium EPSS 2.6% KEV · Not listed
Vendors
Freeradius Redhat
Products
Freeradius Enterprise Linux
CVE-2007-2030

/tmp race in lha

lharc.c in lha does not securely create temporary files, which might allow local users to read or write files by creating a file before LHA is invoked.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Fedora Core
CVE-2007-2052

python off-by-one locale.strxfrm() (possible memory disclosure)

Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allows context-dependent attackers to read portions of memory via unknown manipulations that trigger a buffer over-read due to missing null termination.

CVSS 2.0 · 5.0 Medium EPSS 14.1% KEV · Not listed
Vendors
Python Redhat
Products
Python Enterprise Linux Network Satellite
CVE-2007-2138

PostgreSQL security-definer function privilege escalation

Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."

CVSS 2.0 · 6.0 Medium EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 2 more
CVE-2007-2172

fib_semantics.c out of bounds access vulnerability

A typo in Linux kernel 2.6 before 2.6.21-rc6 and 2.4 before 2.4.35 causes RTA_MAX to be used as an array size instead of RTN_MAX, which leads to an "out of bound access" by the (1) dn_fib_props (dn_fib.c, DECNet) and (2) fib_props (fib_semantics.c, IPv4) functions.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 1 more
CVE-2007-2231

Directory traversal in dovecot with zlib plugin

Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.

CVSS 2.0 · 4.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Dovecot Redhat
Products
Dovecot Enterprise Linux
CVE-2007-2242

IPv6 routing headers issue

The IPv6 protocol allows remote attackers to cause a denial of service via crafted IPv6 type 0 route headers (IPV6_RTHDR_TYPE_0) that create network amplification between two routers.

CVSS 2.0 · 7.8 High EPSS 5.0% KEV · Not listed
Vendors
Freebsd Ietf Netbsd and 2 more
Products
Freebsd Ipv6 Netbsd and 2 more
CVE-2007-2292

security flaw

CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allows remote attackers to conduct HTTP request splitting attacks via LF (%0a) bytes in the username attribute.

CVSS 2.0 · 4.3 Medium EPSS 12.7% KEV · Not listed
Vendors
Microsoft Mozilla Redhat
Products
Internet Explorer Firefox Seamonkey and 1 more
CVE-2007-2348

lftp mirror --script does not escape names and targets of symbolic links

mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script. NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.

CVSS 2.0 · 6.8 Medium EPSS 3.2% KEV · Not listed
Vendors
Alexander V. Lukyanov Redhat
Products
Lftp Enterprise Linux
CVE-2007-2356

Stack overflow in gimp's sunras plugin

Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.

CVSS 2.0 · 6.8 Medium EPSS 15.7% KEV · Not listed
Vendors
Gimp Redhat
Products
Gimp Enterprise Linux
CVE-2007-2442

krb5 RPC library unitialized pointer free

The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup.

CVSS 2.0 · 10.0 Critical EPSS 11.4% KEV · Not listed
Vendors
Canonical Debian Mit and 1 more
Products
Ubuntu Linux Debian Linux Kerberos 5 and 1 more
CVE-2007-2443

krb5 RPC library stack overflow

Integer signedness error in the gssrpc__svcauth_unix function in svc_auth_unix.c in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a negative length value.

CVSS 2.0 · 8.3 High EPSS 3.5% KEV · Not listed
Vendors
Canonical Debian Mit and 1 more
Products
Ubuntu Linux Debian Linux Kerberos 5 and 1 more
CVE-2007-2446

samba heap overflows

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).

CVSS 2.0 · 10.0 Critical EPSS 77.7% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Samba
CVE-2007-2447

samba code injection

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.

CVSS 2.0 · 6.0 Medium EPSS 49.8% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Samba
CVE-2007-2448

subversion: revision properties disclosure to user with partial access

Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit.

CVSS 2.0 · 2.1 Low EPSS 1.5% KEV · Not listed
Vendors
Redhat Subversion
Products
Enterprise Linux Subversion
CVE-2007-2449

tomcat examples jsp XSS

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

CVSS 2.0 · 4.3 Medium EPSS 77.4% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Network Satellite and 1 more
CVE-2007-2450

tomcat host manager XSS

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.

CVSS 2.0 · 3.5 Low EPSS 3.3% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Network Satellite and 1 more
CVE-2007-2453

/dev/random broken

The random number feature in Linux kernel 2.6 before 2.6.20.13, and 2.6.21.x before 2.6.21.4, (1) does not properly seed pools when there is no entropy, or (2) uses an incorrect cast when extracting entropy, which might cause the random number generator to provide the same values after reboots on systems without an entropy source.

CVSS 2.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux