Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 185

Export CSV
CVE-2022-45061

python: CPU denial of service via inefficient IDNA decoder

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Fedoraproject Netapp Python and 1 more
Products
Fedora Active Iq Unified Manager Bootstrap Os and 10 more
CVE-2022-40303

libxml2: integer overflows with XML_PARSE_HUGE

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

CVSS 3.1 · 7.5 High EPSS 41.4% KEV · Not listed
Vendors
Apple Netapp Redhat and 1 more
Products
Ipados Iphone Os Macos and 22 more
CVE-2022-29824

libxml2: integer overflows in xmlBuf and xmlBuffer lead to out-of-bounds write

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

CVSS 3.1 · 6.5 Medium EPSS 3.8% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Active Iq Unified Manager and 23 more
CVE-2022-26488

python: local privilege escalation via search path in Windows

In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable paths into PATH, enabling search-path hijacking of other users and system services. This affects Python (CPython) through 3.7.12, 3.8.x through 3.8.12, 3.9.x through 3.9.10, and 3.10.x through 3.10.2.

CVSS 3.1 · 7.0 High EPSS 1.5% KEV · Not listed
Vendors
Microsoft Netapp Python
Products
Windows Active Iq Unified Manager Ontap Select Deploy Administration Utility and 1 more
CVE-2022-24407

cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed
Vendors
Cyrusimap Debian Fedoraproject and 3 more
Products
Cyrus-sasl Debian Linux Fedora and 11 more
CVE-2022-2097

AES OCB fails to encrypt some bytes

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

CVSS 3.1 · 5.3 Medium EPSS 4.9% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Active Iq Unified Manager and 21 more
CVE-2022-0563

util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Kernel Netapp
Products
Util-linux Ontap Select Deploy Administration Utility
CVE-2022-0391

python: urllib.parse does not sanitize URLs containing ASCII newline and tabs

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

CVSS 3.1 · 7.5 High EPSS 8.5% KEV · Not listed
Vendors
Fedoraproject Netapp Oracle and 2 more
Products
Fedora Active Iq Unified Manager Hci and 9 more
CVE-2021-41617

openssh: privilege escalation when AuthorizedKeysCommand or AuthorizedPrincipalsCommand are configured

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

CVSS 3.1 · 7.0 High EPSS 2.5% KEV · Not listed
Vendors
Fedoraproject Netapp Openbsd and 3 more
Products
Fedora Active Iq Unified Manager Aff 500f and 12 more
CVE-2021-37600

util-linux: integer overflow can lead to buffer overflow in get_sem_elements() in sys-utils/ipcutils.c

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Kernel Netapp
Products
Util-linux Ontap Select Deploy Administration Utility
CVE-2021-35942

glibc: Arbitrary read in wordexp()

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed
Vendors
Debian Gnu Netapp and 1 more
Products
Debian Linux Glibc Active Iq Unified Manager and 5 more
CVE-2021-23336

Web Cache Poisoning

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

CVSS 3.1 · 5.9 Medium EPSS 41.1% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 4 more
Products
Debian Linux Django Fedora and 11 more
CVE-2021-20305

nettle: Out of bounds memory access in signature verification

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 2 more
Products
Debian Linux Fedora Active Iq Unified Manager and 7 more
CVE-2021-3999

glibc: Off-by-one buffer overflow/underflow in getcwd()

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Gnu Netapp and 1 more
Products
Debian Linux Glibc E-series Performance Analyzer and 13 more
CVE-2021-3998

glibc: Unexpected return value from realpath() could leak data based on the application

A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Gnu Netapp
Products
Glibc H300s H300s Firmware and 9 more
CVE-2021-3737

python: urllib: HTTP client possible infinite loop on a 100 Continue response

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 13.2% KEV · Not listed
Vendors
Canonical Fedoraproject Netapp and 3 more
Products
Ubuntu Linux Fedora Hci and 15 more
CVE-2021-3733

python: urllib: Regular expression DoS in AbstractBasicAuthHandler

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

CVSS 3.1 · 6.5 Medium EPSS 4.8% KEV · Not listed
Vendors
Fedoraproject Netapp Python and 1 more
Products
Extra Packages For Enterprise Linux Fedora Hci Compute Node Firmware and 18 more
CVE-2021-3580

nettle: Remote crash in RSA decryption via manipulated ciphertext

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Debian Netapp Nettle Project and 1 more
Products
Debian Linux Ontap Select Deploy Administration Utility Nettle and 1 more