Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 373

Export CSV
CVE-2022-27781

curl: CERTINFO never-ending busy-loop

libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Debian Haxx Netapp and 2 more
Products
Debian Linux Curl Clustered Data Ontap and 14 more
CVE-2022-27780

curl: percent-encoded path separator in URL host

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.

CVSS 3.1 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Haxx Netapp Splunk
Products
Curl Clustered Data Ontap H300s and 15 more
CVE-2022-27775

curl: bad local IPv6 connection reuse

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Broadcom Debian Haxx and 3 more
Products
Fabric Operating System Debian Linux Curl and 15 more
CVE-2022-27774

curl: credential leak on redirect

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

CVSS 3.1 · 5.7 Medium EPSS 2.0% KEV · Not listed
Vendors
Broadcom Debian Haxx and 3 more
Products
Fabric Operating System Debian Linux Curl and 15 more
CVE-2022-22576

curl: OAUTH2 bearer bypass in connection re-use

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

CVSS 3.1 · 8.1 High EPSS 2.5% KEV · Not listed
Vendors
Broadcom Debian Haxx and 3 more
Products
Fabric Operating System Debian Linux Curl and 15 more
CVE-2022-2097

AES OCB fails to encrypt some bytes

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

CVSS 3.1 · 5.3 Medium EPSS 4.9% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Active Iq Unified Manager and 21 more
CVE-2022-0391

python: urllib.parse does not sanitize URLs containing ASCII newline and tabs

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

CVSS 3.1 · 7.5 High EPSS 8.5% KEV · Not listed
Vendors
Fedoraproject Netapp Oracle and 2 more
Products
Fedora Active Iq Unified Manager Hci and 9 more
CVE-2021-45960

expat: Large number of prefixed XML attributes on a single tag can crash libexpat

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

CVSS 3.1 · 8.8 High EPSS 4.7% KEV · Not listed
Vendors
Debian Libexpat Project Netapp and 3 more
Products
Debian Linux Libexpat Active Iq Unified Manager and 7 more
CVE-2021-41617

openssh: privilege escalation when AuthorizedKeysCommand or AuthorizedPrincipalsCommand are configured

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

CVSS 3.1 · 7.0 High EPSS 2.5% KEV · Not listed
Vendors
Fedoraproject Netapp Openbsd and 3 more
Products
Fedora Active Iq Unified Manager Aff 500f and 12 more
CVE-2021-35942

glibc: Arbitrary read in wordexp()

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed
Vendors
Debian Gnu Netapp and 1 more
Products
Debian Linux Glibc Active Iq Unified Manager and 5 more
CVE-2021-33910

systemd: uncontrolled allocation on the stack in function unit_name_path_escape leads to crash

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.

CVSS 3.1 · 5.5 Medium EPSS 8.8% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 2 more
Products
Debian Linux Fedora Hci Management Node and 5 more
CVE-2021-28041

openssh: double-free memory corruption may lead to arbitrary code execution

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

CVSS 3.1 · 7.1 High EPSS 3.5% KEV · Not listed
Vendors
Fedoraproject Netapp Openbsd and 1 more
Products
Fedora Cloud Backup Hci Compute Node and 8 more
CVE-2021-22926

curl: CURLOPT_SSLCERT mixup with Secure Transport

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.

CVSS 3.1 · 7.5 High EPSS 15.1% KEV · Not listed
Vendors
Haxx Netapp Oracle and 2 more
Products
Curl Active Iq Unified Manager Clustered Data Ontap and 23 more
CVE-2021-4209

GnuTLS: Null pointer dereference in MD_UPDATE

A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Gnu Netapp Redhat
Products
Gnutls Active Iq Unified Manager Hci Bootstrap Os and 3 more
CVE-2021-22925

curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

CVSS 3.1 · 5.3 Medium EPSS 5.4% KEV · Not listed
Vendors
Apple Fedoraproject Haxx and 5 more
Products
Mac Os X Macos Fedora and 25 more