Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 189

Export CSV
CVE-2021-28041

openssh: double-free memory corruption may lead to arbitrary code execution

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

CVSS 3.1 · 7.1 High EPSS 3.5% KEV · Not listed
Vendors
Fedoraproject Netapp Openbsd and 1 more
Products
Fedora Cloud Backup Hci Compute Node and 8 more
CVE-2021-4209

GnuTLS: Null pointer dereference in MD_UPDATE

A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Gnu Netapp Redhat
Products
Gnutls Active Iq Unified Manager Hci Bootstrap Os and 3 more
CVE-2021-22901

curl: Use-after-free in TLS session handling when using OpenSSL TLS backend

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.

CVSS 3.1 · 8.1 High EPSS 63.5% KEV · Not listed
Vendors
Haxx Netapp Oracle and 3 more
Products
Curl Active Iq Unified Manager Cloud Backup and 32 more
CVE-2021-22897

curl: Cipher settings shared for all connections when using schannel TLS backed

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

CVSS 3.1 · 5.3 Medium EPSS 4.3% KEV · Not listed
Vendors
Haxx Netapp Oracle and 2 more
Products
Curl Cloud Backup H300e and 27 more
CVE-2021-22876

curl: Leak of authentication credentials in URL via automatic Referer

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

CVSS 3.1 · 5.3 Medium EPSS 5.3% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 6 more
Products
Fabric Operating System Debian Linux Fedora and 12 more
CVE-2021-3733

python: urllib: Regular expression DoS in AbstractBasicAuthHandler

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

CVSS 3.1 · 6.5 Medium EPSS 4.8% KEV · Not listed
Vendors
Fedoraproject Netapp Python and 1 more
Products
Extra Packages For Enterprise Linux Fedora Hci Compute Node Firmware and 18 more
CVE-2020-26116

python: CRLF injection via HTTP request method in httplib/http.client

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.

CVSS 3.1 · 7.2 High EPSS 6.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2020-15778

openssh: scp allows command injection when using backtick characters in the destination argument

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

CVSS 3.1 · 7.8 High EPSS 13.7% KEV · Not listed
Vendors
Broadcom Netapp Openbsd and 1 more
Products
Fabric Operating System A700s A700s Firmware and 8 more
CVE-2020-14145

openssh: Observable discrepancy leading to an information leak in the algorithm negotiation

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

CVSS 3.1 · 5.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Netapp Openbsd Redhat
Products
Active Iq Unified Manager Aff A700s Aff A700s Firmware and 8 more
CVE-2020-13631

sqlite: Virtual table can be renamed into the name of one of its shadow tables

SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Broadcom Canonical and 6 more
Products
Icloud Ipados Iphone Os and 17 more
CVE-2020-13630

sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

CVSS 3.1 · 7.0 High EPSS 1.0% KEV · Not listed
Vendors
Apple Broadcom Canonical and 7 more
Products
Icloud Ipados Iphone Os and 18 more
CVE-2020-8286

curl: Inferior OCSP verification

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 6 more
Products
Mac Os X Macos Debian Linux and 19 more
CVE-2020-8285

curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

CVSS 3.1 · 7.5 High EPSS 9.8% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 7 more
Products
Mac Os X Macos Debian Linux and 29 more
CVE-2020-8284

curl: FTP PASV command response can cause curl to connect to arbitrary host

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

CVSS 3.1 · 3.7 Low EPSS 3.9% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 7 more
Products
Mac Os X Macos Debian Linux and 28 more
CVE-2019-5188

e2fsprogs: Out-of-bounds write in e2fsck/rehash.c

A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian E2fsprogs Project and 4 more
Products
Ubuntu Linux Debian Linux E2fsprogs and 7 more
CVE-2019-17498

libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

CVSS 3.1 · 8.1 High EPSS 3.8% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 3 more
Products
Debian Linux Fedora Libssh2 and 10 more
CVE-2020-35507

binutils: NULL pointer dereference in bfd_pef_parse_function_stubs function in bfd/pef.c

There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability.

CVSS 3.1 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Broadcom Gnu Netapp and 1 more
Products
Brocade Fabric Operating System Binutils Cloud Backup and 6 more
CVE-2020-35496

binutils: NULL pointer dereference in bfd_pef_scan_start_address function in bfd/pef.c

There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Broadcom Fedoraproject Gnu and 1 more
Products
Brocade Fabric Operating System Firmware Fedora Binutils and 6 more