Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,219

Export CSV
CVE-2017-16541

Mozilla: Proxy bypass using automount and autofs

Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in Firefox, aka TorMoil. NOTE: Tails is unaffected.

CVSS 3.1 · 6.5 Medium EPSS 3.7% KEV · Not listed
Vendors
Apple Debian Linux and 2 more
Products
Macos Debian Linux Linux Kernel and 8 more
CVE-2017-16997

glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries

elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.

CVSS 3.0 · 7.8 High EPSS 2.9% KEV · Not listed
Vendors
Gnu Redhat
Products
Glibc Enterprise Linux Enterprise Linux Desktop and 2 more
CVE-2017-3112

flash-plugin: multiple code execution issues fixed in APSB17-33

An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is part of AdobePSDK metadata. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.

CVSS 3.0 · 9.8 Critical EPSS 6.2% KEV · Not listed
Vendors
Adobe Apple Google and 3 more
Products
Flash Player Macos Chrome Os and 8 more
CVE-2017-3265

mysql: unsafe chmod/chown use in init script (CPU Jan 2017)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and earlier and 5.7.16 and earlier. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 5.6 (Confidentiality and Availability impacts).

CVSS 3.1 · 5.6 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 8 more
CVE-2017-3600

mysql: Incorrect input validation allowing code execution via mysqldump

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump). Supported versions that are affected are 5.5.54 and earlier, 5.6.35 and earlier and 5.7.17 and earlier. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. Note: CVE-2017-3600 is equivalent to CVE-2016-5483. CVSS 3.0 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 · 6.6 Medium EPSS 2.7% KEV · Not listed
Vendors
Debian Mariadb Oracle and 1 more
Products
Debian Linux Mariadb Mysql and 8 more
CVE-2017-15041

golang: arbitrary code execution during "go get" or "go get -d"

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

CVSS 3.1 · 9.8 Critical EPSS 8.9% KEV · Not listed
Vendors
Debian Golang Redhat
Products
Debian Linux Go Developer Tools and 6 more
CVE-2017-14496

dnsmasq: integer underflow leading to buffer over-read in the EDNS0 code

Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service via a crafted DNS request.

CVSS 3.0 · 7.5 High EPSS 68.4% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Android and 6 more
CVE-2017-14495

dnsmasq: memory exhaustion vulnerability in the EDNS0 code

Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation.

CVSS 3.0 · 7.5 High EPSS 85.4% KEV · Not listed
Vendors
Canonical Debian Novell and 2 more
Products
Ubuntu Linux Debian Linux Leap and 5 more
CVE-2017-14492

dnsmasq: heap overflow in the IPv6 router advertisement code

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.

CVSS 3.0 · 9.8 Critical EPSS 94.5% KEV · Not listed
Vendors
Canonical Debian Novell and 2 more
Products
Ubuntu Linux Debian Linux Leap and 6 more
CVE-2017-14491

dnsmasq: heap overflow in the code responsible for building DNS replies

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

CVSS 3.1 · 9.8 Critical EPSS 86.5% KEV · Not listed
Vendors
Arista Arubanetworks Canonical and 10 more
Products
Eos Arubaos Ubuntu Linux and 32 more
CVE-2017-14493

dnsmasq: stack buffer overflow in the DHCPv6 code

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.

CVSS 3.0 · 9.8 Critical EPSS 85.2% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Leap and 6 more
CVE-2017-13704

dnsmasq: Size parameter overflow via large DNS query

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.

CVSS 3.0 · 7.5 High EPSS 65.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2017-14064

ruby: Arbitrary heap exposure during a JSON.generate call

Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.

CVSS 3.0 · 9.8 Critical EPSS 9.4% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 8 more
CVE-2017-14494

dnsmasq: information leak in the DHCPv6 relay code

dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded requests.

CVSS 3.0 · 5.9 Medium EPSS 70.5% KEV · Not listed
Vendors
Canonical Debian Novell and 2 more
Products
Ubuntu Linux Debian Linux Leap and 6 more
CVE-2017-13084

wpa_supplicant: reinstallation of the STK key in the PeerKey handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 9 more
CVE-2017-13082

wpa_supplicant: Accepting a retransmitted FT Reassociation Request and reinstalling the pairwise key while processing it

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 8.1 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13086

wpa_supplicant: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more