Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,046

Export CSV
CVE-2020-25212

kernel: TOCTOU mismatch in the NFS client code

A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have unspecified other impact because a size check is in fs/nfs/nfs4proc.c instead of fs/nfs/nfs4xdr.c, aka CID-b4487b935452.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 7 more
CVE-2020-25211

kernel: Local buffer overflow in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c

In the Linux kernel through 5.8.7, local attackers able to inject conntrack netlink configuration could overflow a local buffer, causing crashes or triggering use of incorrect protocol numbers in ctnetlink_parse_tuple_filter in net/netfilter/nf_conntrack_netlink.c, aka CID-1cc5ef91d2ff.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 6 more
CVE-2020-24394

kernel: umask not applied on filesystem without ACL support

In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Opensuse and 3 more
Products
Ubuntu Linux Linux Kernel Leap and 8 more
CVE-2020-1749

kernel: some ipv6 protocols not encrypted over ipsec tunnel

A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2020-1702

containers/image: Container images read entire image manifest into memory

A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker can use this flaw to trick a user, with privileges to pull container images, into crashing the process responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Containers-image Project Redhat
Products
Containers-image Enterprise Linux Openshift and 1 more
CVE-2020-16016

chromium-browser: Inappropriate implementation in base

Inappropriate implementation in base in Google Chrome prior to 86.0.4240.193 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2020-16008

chromium-browser: Stack buffer overflow in WebRTC

Stack buffer overflow in WebRTC in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit stack corruption via a crafted WebRTC packet.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 3 more
CVE-2020-16006

chromium-browser: Inappropriate implementation in V8

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 3 more
CVE-2020-16005

chromium-browser: Insufficient policy enforcement in ANGLE

Insufficient policy enforcement in ANGLE in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 3 more
CVE-2020-16004

chromium-browser: Use after free in user interface

Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 3 more
CVE-2020-16003

chromium-browser: Use after free in printing

Use after free in printing in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 2 more
CVE-2020-16002

chromium-browser: Use after free in PDFium

Use after free in PDFium in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 2 more
CVE-2020-16001

chromium-browser: Use after free in media

Use after free in media in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 2 more
CVE-2020-16000

chromium-browser: Inappropriate implementation in Blink

Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 2 more
CVE-2020-15992

chromium-browser: Insufficient policy enforcement in networking

Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 2 more
CVE-2020-15991

chromium-browser: Use after free in password manager

Use after free in password manager in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 2 more
CVE-2020-15990

chromium-browser: Use after free in autofill

Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 2 more
CVE-2020-15989

chromium-browser: Uninitialized use in PDFium

Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 2 more
CVE-2020-15988

chromium-browser: Insufficient policy enforcement in downloads

Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the user to open files to execute arbitrary code via a crafted HTML page.

CVSS 3.1 · 6.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 3 more
CVE-2020-15987

chromium-browser: Use after free in WebRTC

Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC stream.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 2 more