Export limit exceeded: 55493 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,301

Export CSV
CVE-2018-12475

obs-service-download_files allows downloading from localhost or intranet hosts

A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticated users to generate HTTP request against internal networks and potentially downloading data that is exposed there. This issue affects: openSUSE Open Build Service .

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse
Products
Open Build Service
CVE-2018-12474

Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm

Improper input validation in obs-service-tar_scm of Open Build Service allows remote attackers to cause access and extract information outside the current build or cause the creation of file in attacker controlled locations. Affected releases are openSUSE Open Build Service: versions prior to 51a17c553b6ae2598820b7a90fd0c11502a49106.

CVSS 3.0 · 5.4 Medium EPSS 1.4% KEV · Not listed
Vendors
Opensuse
Products
Tar Scm
CVE-2018-12473

path traversal in obs-service-tar_scm

A path traversal traversal vulnerability in obs-service-tar_scm of Open Build Service allows remote attackers to cause access files not in the current build. On the server itself this is prevented by confining the worker via KVM. Affected releases are openSUSE Open Build Service: versions prior to 70d1aa4cc4d7b940180553a63805c22fc62e2cf0.

CVSS 3.0 · 3.1 Low EPSS 1.8% KEV · Not listed
Vendors
Opensuse
Products
Open Build Service
CVE-2018-12467

delete package via link exploit in open buildservice

Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.

CVSS 3.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse
Products
Open Build Service
CVE-2018-12466

openbuildservice allowed deleting packages via project links

openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.

CVSS 3.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse
Products
Open Build Service
CVE-2018-12207

hw: Machine Check Error on Page Size Change (IFU)

Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian F5 and 5 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 1538 more
CVE-2018-12180

edk2: Buffer Overflow in BlockIo service for RAM disk

Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via network access.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Opensuse Redhat Tianocore
Products
Leap Enterprise Linux Edk Ii
CVE-2018-12085

liblouis: Stack-based buffer overflow in compileTranslationTable.c

Liblouis 3.6.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.

CVSS 3.0 · 8.8 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Liblouis Opensuse and 1 more
Products
Ubuntu Linux Liblouis Leap and 1 more
CVE-2018-11685

liblouis: Stack-based buffer overflow in function compileHyphenation in compileTranslationTable.c

Liblouis 3.5.0 has a stack-based Buffer Overflow in the function compileHyphenation in compileTranslationTable.c.

CVSS 3.0 · 8.8 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Liblouis Opensuse and 1 more
Products
Ubuntu Linux Liblouis Leap and 1 more
CVE-2018-11684

liblouis: Stack-based buffer overflow in function includeFile in compileTranslationTable.c

Liblouis 3.5.0 has a stack-based Buffer Overflow in the function includeFile in compileTranslationTable.c.

CVSS 3.0 · 8.8 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Liblouis Opensuse and 1 more
Products
Ubuntu Linux Liblouis Leap and 1 more
CVE-2018-11683

liblouis: Stack-based buffer overflow in function parseChars in compileTranslationTable.c

Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.

CVSS 3.0 · 8.8 High EPSS 2.1% KEV · Not listed
Vendors
Canonical Liblouis Opensuse
Products
Ubuntu Linux Liblouis Leap
CVE-2018-10930

glusterfs: Files can be renamed outside volume

A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the gluster volume.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Debian Gluster Opensuse and 1 more
Products
Debian Linux Glusterfs Leap and 5 more
CVE-2018-10929

glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code

A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute arbitrary code on glusterfs server nodes.

CVSS 3.1 · 8.8 High EPSS 3.3% KEV · Not listed
Vendors
Debian Gluster Opensuse and 1 more
Products
Debian Linux Glusterfs Leap and 4 more
CVE-2018-10928

glusterfs: Improper resolution of symlinks allows for privilege escalation

A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster volume. An authenticated attacker could use this flaw to create arbitrary symlinks pointing anywhere on the server and execute arbitrary code on glusterfs server nodes.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Debian Gluster Opensuse and 1 more
Products
Debian Linux Glusterfs Leap and 5 more
CVE-2018-10927

glusterfs: File status information leak and denial of service

A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute remote denial of service by crashing gluster brick process.

CVSS 3.1 · 8.1 High EPSS 2.6% KEV · Not listed
Vendors
Debian Gluster Opensuse and 1 more
Products
Debian Linux Glusterfs Leap and 4 more
CVE-2018-10926

glusterfs: Device files can be created in arbitrary locations

A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrary location via path traversal and execute arbitrary code on a glusterfs server node.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed
Vendors
Debian Gluster Opensuse and 1 more
Products
Debian Linux Glusterfs Leap and 4 more
CVE-2018-10923

glusterfs: I/O to arbitrary devices on storage server

It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated attacker could use this to create an arbitrary device and read data from any device attached to the glusterfs server node.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed
Vendors
Debian Gluster Opensuse and 1 more
Products
Debian Linux Glusterfs Leap and 4 more
CVE-2018-10916

lftp: particular remote file names may lead to current working directory erased

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.

CVSS 3.0 · 5.3 Medium EPSS 4.8% KEV · Not listed
Vendors
Canonical Lftp Project Opensuse and 1 more
Products
Ubuntu Linux Lftp Leap and 1 more