Export limit exceeded: 425850 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425850 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,386

Export CSV
CVE-2021-3449

NULL pointer deref in signature_algorithms processing

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

CVSS 3.1 · 5.9 Medium EPSS 63.5% KEV · Not listed
Vendors
Checkpoint Debian Fedoraproject and 10 more
Products
Multi-domain Management Multi-domain Management Firmware Quantum Security Gateway and 169 more
CVE-2020-35496

binutils: NULL pointer dereference in bfd_pef_scan_start_address function in bfd/pef.c

There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Broadcom Fedoraproject Gnu and 1 more
Products
Brocade Fabric Operating System Firmware Fedora Binutils and 6 more
CVE-2020-35495

binutils: NULL pointer dereference in bfd_pef_parse_symbols function in bfd/pef.c

There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34.

CVSS 3.1 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Broadcom Fedoraproject Gnu and 1 more
Products
Brocade Fabric Operating System Firmware Fedora Binutils and 6 more
CVE-2020-35494

binutils: usage of unitialized heap in tic4x_print_cond function in opcodes/tic4x-dis.c

There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed by binutils could cause usage of uninitialized memory. The highest threat is to application availability with a lower threat to data confidentiality. This flaw affects binutils versions prior to 2.34.

CVSS 3.1 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Broadcom Fedoraproject Gnu and 1 more
Products
Brocade Fabric Operating System Firmware Fedora Binutils and 6 more
CVE-2020-35493

binutils: heap-based buffer overflow in bfd_pef_parse_function_stubs function in bfd/pef.c via crafted PEF file

A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump could cause a heap buffer overflow -> out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Broadcom Fedoraproject Gnu and 1 more
Products
Brocade Fabric Operating System Firmware Fedora Binutils and 6 more
CVE-2020-11987

batik: SSRF due to improper input validation by the NodePickerPanel

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

CVSS 3.1 · 8.2 High EPSS 13.6% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 2 more
Products
Batik Debian Linux Fedora and 20 more
CVE-2020-11979

ant: insecure temporary file

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

CVSS 3.1 · 7.5 High EPSS 7.8% KEV · Not listed
Vendors
Apache Fedoraproject Gradle and 2 more
Products
Ant Fedora Gradle and 35 more
CVE-2019-20445

netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

CVSS 3.1 · 9.1 Critical EPSS 13.8% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Spark Ubuntu Linux Debian Linux and 17 more
CVE-2019-20444

netty: HTTP request smuggling

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

CVSS 3.1 · 9.1 Critical EPSS 8.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 16 more
CVE-2019-1551

rsaz_512_sqr overflow bug on x86_64

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

CVSS 3.1 · 5.3 Medium EPSS 14.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 8 more
CVE-2019-10086

apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CVSS 3.1 · 7.3 High EPSS 29.1% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 3 more
Products
Commons Beanutils Nifi Debian Linux and 70 more
CVE-2023-51764

postfix: SMTP smuggling vulnerability

Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

CVSS 3.1 · 5.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Postfix Redhat
Products
Fedora Postfix Enterprise Linux
CVE-2022-36227

libarchive: NULL pointer dereference in archive_write.c

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Debian Fedoraproject Libarchive and 2 more
Products
Debian Linux Fedora Libarchive and 3 more
CVE-2022-33070

protobuf-c: invalid arithmetic shift via the function parse_tag_and_wiretype may lead to DoS

Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parse_tag_and_wiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Protobuf-c Project
Products
Fedora Protobuf-c
CVE-2022-2344

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Vim
Products
Fedora Vim
CVE-2022-2343

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Vim
Products
Fedora Vim