Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,246

Export CSV
CVE-2019-0564

Core: Kestrel - WebSocket DoS via CancellationToken (CoreFX and ASP.NET)

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.

CVSS 3.0 · 7.5 High EPSS 8.4% KEV · Not listed
Vendors
Microsoft Redhat
Products
Asp.net Core Rhel Dotnet
CVE-2019-0548

Core: AspNetCoreModule WebSocket DOS

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0564.

CVSS 3.0 · 7.5 High EPSS 8.2% KEV · Not listed
Vendors
Microsoft Redhat
Products
Asp.net Core Rhel Dotnet
CVE-2019-0205

thrift: Endless loop when feed with specific input data

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.

CVSS 3.1 · 7.5 High EPSS 9.2% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Thrift Communications Cloud Native Core Network Slice Selection Function Enterprise Linux Server and 6 more
CVE-2019-0199

tomcat: Apache Tomcat HTTP/2 DoS

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

CVSS 3.0 · 7.5 High EPSS 72.9% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Jboss Enterprise Web Server Openshift Application Runtimes
CVE-2019-0161

edk2: stack overflow in XHCI causing denial of service

Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Tianocore
Products
Enterprise Linux Edk Ii
CVE-2019-0059

Junos OS: The routing protocol process (rpd) may crash and generate core files upon receipt of specific valid BGP states from a peered host.

A memory leak vulnerability in the of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the device by sending specific commands from a peered BGP host and having those BGP states delivered to the vulnerable device. This issue affects: Juniper Networks Junos OS: 18.1 versions prior to 18.1R2-S4, 18.1R3-S1; 18.1X75 all versions. Versions before 18.1R1 are not affected.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Juniper
Products
Junos
CVE-2019-0046

Junos OS: EX4300 Series: Denial of Service upon receipt of large number of specific valid packets on management interface.

A vulnerability in the pfe-chassisd Chassis Manager (CMLC) daemon of Juniper Networks Junos OS allows an attacker to cause a Denial of Service (DoS) to the EX4300 when specific valid broadcast packets create a broadcast storm condition when received on the me0 interface of the EX4300 Series device. A reboot of the device is required to restore service. Continued receipt of these valid broadcast packets will create a sustained Denial of Service (DoS) against the device. Affected releases are Juniper Networks Junos OS: 16.1 versions above and including 16.1R1 prior to 16.1R7-S5; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S2; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Juniper
Products
Junos
CVE-2019-0038

SRX Series: Crafted packets destined to fxp0 management interface on SRX340/SRX345 devices can lead to DoS

Crafted packets destined to the management interface (fxp0) of an SRX340 or SRX345 services gateway may create a denial of service (DoS) condition due to buffer space exhaustion. This issue only affects the SRX340 and SRX345 services gateways. No other products or platforms are affected by this vulnerability. Affected releases are Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D160 on SRX340/SRX345; 17.3 on SRX340/SRX345; 17.4 versions prior to 17.4R2-S3, 17.4R3 on SRX340/SRX345; 18.1 versions prior to 18.1R3-S1 on SRX340/SRX345; 18.2 versions prior to 18.2R2 on SRX340/SRX345; 18.3 versions prior to 18.3R1-S2, 18.3R2 on SRX340/SRX345. This issue does not affect Junos OS releases prior to 15.1X49 on any platform.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Juniper
Products
Junos Srx340 Srx345
CVE-2019-0033

SRX Series: A remote attacker may cause a high CPU Denial of Service to the device when proxy ARP is configured.

A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high CPU condition leading to a Denial of Service (DoS). This issue affects only IPv4. Affected releases are Juniper Networks Junos OS: 12.1X46 versions above and including 12.1X46-D25 prior to 12.1X46-D71, 12.1X46-D73 on SRX Series; 12.3X48 versions prior to 12.3X48-D50 on SRX Series; 15.1X49 versions prior to 15.1X49-D75 on SRX Series.

CVSS 3.0 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Juniper
Products
Junos Srx100 Srx110 and 11 more
CVE-2019-0031

Junos OS: jdhcpd daemon memory consumption Denial of Service when receiving specific IPv6 DHCP packets.

Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Junos OS device using the jdhcpd daemon configured to respond to IPv6 requests. Once started, memory consumption will eventually impact any IPv4 or IPv6 request serviced by the jdhcpd daemon, thus creating a Denial of Service (DoS) condition to clients requesting and not receiving IP addresses. Additionally, some clients which were previously holding IPv6 addresses will not have their IPv6 Identity Association (IA) address and network tables agreed upon by the jdhcpd daemon after the failover event occurs, which leads to more than one interface, and multiple IP addresses, being denied on the client. Affected releases are Juniper Networks Junos OS: 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Juniper
Products
Junos
CVE-2018-9996

binutils: Stack-overflow in libiberty/cplus-dem.c causes crash

An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_template_value_parm, demangle_integral_value, and demangle_expression.

CVSS 3.0 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Gnu
Products
Binutils
CVE-2018-9918

qpdf: stack exhaustion in QPDFObjectHandle and QPDF_Dictionary classes in libqpdf.a

libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing remote attackers to cause a denial of service (stack exhaustion), related to the QPDFObjectHandle and QPDF_Dictionary classes, because nesting in direct objects is not restricted.

CVSS 3.0 · 7.8 High EPSS 1.7% KEV · Not listed
Vendors
Canonical Qpdf Project
Products
Ubuntu Linux Qpdf
CVE-2018-9415

kernel: race condition in the ARM Advanced Microcontroller Bus Architecture (AMBA) driver

In driver_override_store and driver_override_show of bus.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-69129004 References: Upstream kernel.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Google
Products
Ubuntu Linux Android
CVE-2018-9274

wireshark: memory leak in ui/failure_message.c

In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, ui/failure_message.c has a memory leak.

CVSS 3.0 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2018-9273

wireshark: memory leak in epan/dissectors/packet-pcp.c

In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-pcp.c has a memory leak.

CVSS 3.0 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Debian Wireshark
Products
Debian Linux Wireshark
CVE-2018-9272

wireshark: memory leak in epan/dissectors/packet-h223.c

In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-h223.c has a memory leak.

CVSS 3.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2018-9271

wireshark: memory leak in epan/dissectors/packet-multipart.c

In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-multipart.c has a memory leak.

CVSS 3.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2018-9269

wireshark: memory leak in epan/dissectors/packet-giop.c

In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-giop.c has a memory leak.

CVSS 3.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Debian Wireshark
Products
Debian Linux Wireshark
CVE-2018-9268

wireshark: memory leak in epan/dissectors/packet-smb2.c

In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-smb2.c has a memory leak.

CVSS 3.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Debian Wireshark
Products
Debian Linux Wireshark