Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,090

Export CSV
CVE-2021-3999

glibc: Off-by-one buffer overflow/underflow in getcwd()

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Gnu Netapp and 1 more
Products
Debian Linux Glibc E-series Performance Analyzer and 13 more
CVE-2021-3759

kernel: unaccounted ipc objects in Linux kernel lead to breaking memcg limits and DoS attacks

A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux
CVE-2021-3580

nettle: Remote crash in RSA decryption via manipulated ciphertext

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Debian Netapp Nettle Project and 1 more
Products
Debian Linux Ontap Select Deploy Administration Utility Nettle and 1 more
CVE-2021-3537

libxml2: NULL pointer dereference when post-validating mixed content parsed in recovery mode

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.9 Medium EPSS 3.6% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Active Iq Unified Manager and 18 more
CVE-2021-3518

libxml2: Use-after-free in xmlXIncludeDoProcess() in xinclude.c

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

CVSS 3.1 · 8.8 High EPSS 21.9% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Active Iq Unified Manager and 17 more
CVE-2021-3517

libxml2: Heap-based buffer overflow in xmlEncodeEntitiesInternal() in entities.c

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

CVSS 3.1 · 8.6 High EPSS 17.0% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Active Iq Unified Manager and 27 more
CVE-2021-3516

libxml2: Use-after-free in xmlEncodeEntitiesInternal() in entities.c

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Clustered Data Ontap and 7 more
CVE-2021-3426

python: Information disclosure via pydoc

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.

CVSS 3.1 · 5.7 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Cloud Backup and 8 more
CVE-2021-3326

glibc: Assertion failure in ISO-2022-JP-3 gconv module related to combining characters

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Debian Fujitsu Gnu and 3 more
Products
Debian Linux M10-1 M10-1 Firmware and 15 more
CVE-2021-3177

python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

CVSS 3.1 · 9.8 Critical EPSS 24.0% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Active Iq Unified Manager and 9 more
CVE-2020-36230

openldap: Assertion failure in ber_next_element in decode.c

A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 12.1% KEV · Not listed
Vendors
Apache Apple Debian and 1 more
Products
Bookkeeper Mac Os X Macos and 2 more
CVE-2020-36229

openldap: Type confusion in ad_keystring in ad.c

A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Apple Debian Openldap
Products
Mac Os X Macos Debian Linux and 1 more
CVE-2020-36228

openldap: Integer underflow in issuerAndThisUpdateCheck in schema_init.c

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 85.0% KEV · Not listed
Vendors
Apple Debian Openldap
Products
Macos Debian Linux Openldap
CVE-2020-36227

openldap: Infinite loop in slapd with the cancel_extop Cancel operation

A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 77.2% KEV · Not listed
Vendors
Apple Debian Openldap
Products
Macos Debian Linux Openldap
CVE-2020-36226

openldap: Denial of service via length miscalculation in slap_parse_user

A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 4.2% KEV · Not listed
Vendors
Apple Debian Openldap
Products
Mac Os X Macos Debian Linux and 1 more
CVE-2020-36225

openldap: Double free in the saslAuthzTo processing

A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Apple Debian Openldap
Products
Macos Debian Linux Openldap
CVE-2020-36224

openldap: Invalid pointer free in the saslAuthzTo processing

A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Apple Debian Openldap
Products
Mac Os X Macos Debian Linux and 1 more
CVE-2020-36223

openldap: Out-of-bounds read in Values Return Filter

A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read).

CVSS 3.1 · 7.5 High EPSS 4.2% KEV · Not listed
Vendors
Apple Debian Openldap
Products
Mac Os X Macos Debian Linux and 1 more
CVE-2020-36222

openldap: Assertion failure in slapd in the saslAuthzTo validation

A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.

CVSS 3.1 · 7.5 High EPSS 77.2% KEV · Not listed
Vendors
Apple Debian Openldap
Products
Mac Os X Macos Debian Linux and 1 more
CVE-2020-36221

openldap: Integer underflow in serialNumberAndIssuerCheck in schema_init.c

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).

CVSS 3.1 · 7.5 High EPSS 85.0% KEV · Not listed
Vendors
Apple Debian Openldap
Products
Mac Os X Macos Debian Linux and 1 more