Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 349

Export CSV
CVE-2018-2581

JDK: unspecified vulnerability fixed in 7u171, 8u161, and 9.0.4 (JavaFX)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX). Supported versions that are affected are Java SE: 7u161, 8u152 and 9.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N).

CVSS 3.1 · 4.7 Medium EPSS 2.5% KEV · Not listed
Vendors
Netapp Oracle Redhat
Products
Active Iq Unified Manager Cloud Backup E-series Santricity Management Plug-ins and 19 more
CVE-2018-25020

kernel: long jump over an instruction sequence can lead to overflow in the BPF subsystem

The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an instruction sequence where inner instructions require substantial expansions into multiple BPF instructions, leading to an overflow. This affects kernel/bpf/core.c and net/core/filter.c.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Netapp
Products
Linux Kernel Cloud Backup H300e and 15 more
CVE-2018-20796

glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.

CVSS 3.0 · 7.5 High EPSS 5.8% KEV · Not listed
Vendors
Gnu Netapp
Products
Glibc Cloud Backup Ontap Select Deploy Administration Utility and 1 more
CVE-2018-1333

DoS for HTTP/2 connections by crafted requests

By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).

CVSS 3.0 · 7.5 High EPSS 17.0% KEV · Not listed
Vendors
Apache Canonical Netapp and 1 more
Products
Http Server Ubuntu Linux Cloud Backup and 4 more
CVE-2018-1312

httpd: Weak Digest auth nonce generation in mod_auth_digest

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.

CVSS 3.1 · 9.8 Critical EPSS 15.8% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Http Server Ubuntu Linux Debian Linux and 12 more
CVE-2018-18065

net-snmp: NULL pointer exception in _set_key in agent/helpers/table_container.c resulting in a denial of service

_set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.

CVSS 3.0 · 6.5 Medium EPSS 17.5% KEV · Not listed
Vendors
Canonical Debian Net-snmp and 2 more
Products
Ubuntu Linux Debian Linux Net-snmp and 7 more
CVE-2018-16871

kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence

A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Cloud Backup H300e and 28 more
CVE-2009-5155

glibc: parse_reg_exp in posix/regcomp.c misparses alternatives leading to denial of service or trigger incorrect result

In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.

CVSS 3.0 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Gnu Netapp
Products
Glibc Cloud Backup Ontap Select Deploy Administration Utility and 1 more