Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 826

Export CSV
CVE-2013-2206

kernel: sctp: duplicate cookie handling NULL pointer dereference

The sctp_sf_do_5_2_4_dupcook function in net/sctp/sm_statefuns.c in the SCTP implementation in the Linux kernel before 3.8.5 does not properly handle associations during the processing of a duplicate COOKIE ECHO chunk, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted SCTP traffic.

CVSS 2.0 · 5.4 Medium EPSS 4.7% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Openstack
CVE-2013-2232

Kernel: ipv6: using ipv4 vs ipv6 structure during routing lookup in sendmsg

The ip6_sk_dst_check function in net/ipv6/ip6_output.c in the Linux kernel before 3.10 allows local users to cause a denial of service (system crash) by using an AF_INET6 socket for a connection to an IPv4 interface.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2013-2237

Kernel: net: af_key: initialize satype in key_notify_policy_flush

The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2013-2256

OpenStack: Nova private flavors resource limit circumvention

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

CVSS 2.0 · 6.0 Medium EPSS 1.8% KEV · Not listed
Vendors
Openstack Redhat
Products
Nova Openstack
CVE-2013-2274

Puppet: HTTP PUT report saving code execution vulnerability

Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.

CVSS 2.0 · 6.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Puppet Puppetlabs Redhat
Products
Puppet Puppet Enterprise Puppet and 1 more
CVE-2013-2275

Puppet: default auth.conf allows authenticated node to submit a report for any other node

The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.

CVSS 2.0 · 4.0 Medium EPSS 2.9% KEV · Not listed
Vendors
Canonical Puppet Puppetlabs and 1 more
Products
Ubuntu Linux Puppet Puppet Enterprise and 2 more
CVE-2013-2634

kernel: Information leak in the Data Center Bridging (DCB) component

net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2013-2635

kernel: Information leak in the RTNETLINK component

The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2013-2852

kernel: b43: format string leaking into error msgs

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message.

CVSS 2.0 · 6.9 Medium EPSS 1.0% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 4 more
CVE-2013-2882

v8: remote DoS or unspecified other impact via type confusion

Google V8, as used in Google Chrome before 28.0.1500.95, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."

CVSS 2.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Debian Google Nodejs and 1 more
Products
Debian Linux Chrome Node.js and 3 more
CVE-2013-3222

Kernel: atm: update msg_namelen in vcc_recvmsg()

The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2013-3224

Kernel: Bluetooth: possible info leak in bt_sock_recvmsg()

The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2013-3225

Kernel: Bluetooth: RFCOMM - missing msg_namelen update in rfcomm_sock_recvmsg

The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2013-3301

Kernel: tracing: NULL pointer dereference

The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for write access to the (1) set_ftrace_pid or (2) set_graph_function file, and then making an lseek system call.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat Suse
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 4 more
CVE-2013-3567

puppet: remote code execution on master from unauthenticated clients

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

CVSS 2.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Canonical Novell Puppet and 2 more
Products
Ubuntu Linux Suse Linux Enterprise Desktop Suse Linux Enterprise Server and 4 more
CVE-2013-4073

ruby: hostname check bypassing vulnerability in SSL client

The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

CVSS 2.0 · 6.8 Medium EPSS 2.8% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Openshift Openstack and 1 more
CVE-2013-4111

OpenStack: python-glanceclient failing SSL certificate check

The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 2.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Openstack Opensuse Redhat
Products
Python Glanceclient Opensuse Openstack
CVE-2013-4155

OpenStack: Swift Denial of Service using superfluous object tombstones

OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.

CVSS 2.0 · 4.0 Medium EPSS 1.7% KEV · Not listed
Vendors
Openstack Redhat
Products
Folsom Grizzly Havana and 2 more
CVE-2013-4162

Kernel: net: panic while pushing pending data out of a IPv6 socket with UDP_CORK enabled

The udp_v6_push_pending_frames function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel through 3.10.3 makes an incorrect function call for pending data, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.

CVSS 2.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2013-4164

ruby: heap overflow in floating point parsing

Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.

CVSS 2.0 · 6.8 Medium EPSS 35.0% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Cloudforms Managementengine Enterprise Linux Openstack and 3 more