Export limit exceeded: 425852 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,139

Export CSV
CVE-2023-39615

libxml2: crafted xml can cause global buffer overflow

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat Xmlsoft
Products
Enterprise Linux Jboss Core Services Openshift and 3 more
CVE-2023-7104

SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflow

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Redhat Sqlite
Products
Fedora Enterprise Linux Openshift and 3 more
CVE-2021-28363

python-urllib3: HTTPS proxy host name not validated when using default SSLContext

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Fedoraproject Oracle Python and 1 more
Products
Fedora Peoplesoft Enterprise Peopletools Urllib3 and 1 more
CVE-2020-29573

glibc: stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern

sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of "Fixed for glibc 2.33" in the 26649 reference.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Gnu Netapp Redhat
Products
Glibc Cloud Backup Solidfire Baseboard Management Controller and 6 more
CVE-2020-8177

curl: Incorrect argument check can allow remote servers to overwrite local files

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed
Vendors
Debian Fujitsu Haxx and 3 more
Products
Debian Linux M10-1 M10-1 Firmware and 16 more
CVE-2020-1712

systemd: use-after-free when asynchronous polkit queries are performed

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Redhat Systemd Project
Products
Debian Linux Ceph Storage Discovery and 5 more
CVE-2020-10029

glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions

The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2019-25013

glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding

The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

CVSS 3.1 · 5.9 Medium EPSS 3.6% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 3 more
Products
Fabric Operating System Debian Linux Fedora and 9 more
CVE-2019-20907

python: infinite loop in the tarfile module via crafted TAR archive

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVSS 3.1 · 5.5 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2019-9636

python: Information Disclosure due to urlsplit improper NFKC normalization

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVSS 3.1 · 5.3 Medium EPSS 7.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2019-5188

e2fsprogs: Out-of-bounds write in e2fsck/rehash.c

A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian E2fsprogs Project and 4 more
Products
Ubuntu Linux Debian Linux E2fsprogs and 7 more
CVE-2019-5094

e2fsprogs: Crafted ext4 partition leads to out-of-bounds write

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian E2fsprogs Project and 3 more
Products
Ubuntu Linux Debian Linux E2fsprogs and 5 more
CVE-2019-19126

glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2019-17498

libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

CVSS 3.1 · 8.1 High EPSS 3.8% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 3 more
Products
Debian Linux Fedora Libssh2 and 10 more
CVE-2019-15903

expat: heap-based buffer over-read via crafted XML input

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

CVSS 3.1 · 6.5 Medium EPSS 6.6% KEV · Not listed
Vendors
Libexpat Project Python Redhat
Products
Libexpat Python Enterprise Linux and 2 more