Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 130

Export CSV
CVE-2018-14647

python: Missing salt initialization in _elementtree.c module

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

CVSS 3.1 · 7.5 High EPSS 10.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2018-16842

curl: Heap-based buffer over-read in the curl tool warning formatting

Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

CVSS 3.0 · 4.4 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Haxx and 1 more
Products
Ubuntu Linux Debian Linux Curl and 3 more
CVE-2018-14618

curl: NTLM password overflow via integer overflow

curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)

CVSS 3.0 · 7.5 High EPSS 10.7% KEV · Not listed
Vendors
Canonical Debian Haxx and 1 more
Products
Ubuntu Linux Debian Linux Libcurl and 3 more
CVE-2019-11729

nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault

Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Thunderbird Ansible Tower and 1 more
CVE-2020-7676

nodejs-angular: XSS due to regex-based HTML replacement

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.

CVSS 3.1 · 5.4 Medium EPSS 1.9% KEV · Not listed
Vendors
Angularjs Redhat
Products
Angularjs Amq Broker Ansible Tower and 2 more
CVE-2020-11023

Potential XSS vulnerability in jQuery

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS 3.1 · 6.9 Medium EPSS 84.9% KEV · Listed
Vendors
Debian Drupal Fedoraproject and 5 more
Products
Debian Linux Drupal Fedora and 75 more
CVE-2018-15686

systemd: reexec state injection: fgets() on overlong lines leads to line splitting

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly lead to root privilege escalation. Affected releases are systemd versions up to and including 239.

CVSS 3.1 · 7.8 High EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Communications Cloud Native Core Network Function Cloud Native Environment and 7 more
CVE-2018-16866

systemd: out-of-bounds read when parsing a crafted syslog message

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.

CVSS 3.1 · 3.3 Low EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian Netapp and 2 more
Products
Ubuntu Linux Debian Linux Active Iq Performance Analytics Services and 23 more
CVE-2015-2716

expat: Integer overflow leading to buffer overflow in XML_GetBuffer()

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.

CVSS 2.0 · 7.5 High EPSS 7.2% KEV · Not listed
Vendors
Mozilla Novell Opensuse and 2 more
Products
Firefox Firefox Esr Thunderbird and 8 more
CVE-2015-8035

libxml2: DoS caused by incorrect error detection during XZ decompression

The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.

CVSS 2.0 · 2.6 Low EPSS 3.3% KEV · Not listed
Vendors
Apple Canonical Debian and 2 more
Products
Iphone Os Mac Os X Tvos and 7 more
CVE-2018-20060

python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

CVSS 3.0 · 9.8 Critical EPSS 4.5% KEV · Not listed
Vendors
Fedoraproject Python Redhat
Products
Fedora Urllib3 Ansible Tower and 1 more
CVE-2021-4112

ansible-tower: Privilege escalation via job isolation escape

A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Automation Platform Early Access Ansible Automation Platform Text-only Advisories and 2 more
CVE-2021-3583

ansible: Template Injection through yaml multi-line strings with ansible facts used in template.

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Engine Ansible Tower
CVE-2021-3447

ansible: multiple modules expose secured values

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Ansible Ansible Automation Platform and 4 more
CVE-2021-20253

ansible-tower: Privilege escalation via job isolation escape

A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Ansible Tower
CVE-2021-20228

ansible: basic.py no_log with fallback option

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Ansible Automation Platform Ansible Engine and 3 more
CVE-2021-20191

ansible: multiple modules expose secured values

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle Redhat
Products
Virtualization Ansible Ansible Automation Platform and 9 more
CVE-2021-20178

ansible: user data leak in snmp_facts module

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Ansible Ansible Automation Platform and 4 more
CVE-2020-7743

Prototype Pollution

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.

CVSS 3.1 · 7.3 High EPSS 3.9% KEV · Not listed
Vendors
Mathjs Redhat
Products
Mathjs Ansible Tower