Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,250

Export CSV
CVE-2020-7788

Prototype Pollution

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

CVSS 3.1 · 7.3 High EPSS 3.7% KEV · Not listed
Vendors
Debian Ini Project Redhat
Products
Debian Linux Ini Enterprise Linux and 2 more
CVE-2020-36558

kernel: race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference

A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus and 2 more
CVE-2022-36227

libarchive: NULL pointer dereference in archive_write.c

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Debian Fedoraproject Libarchive and 2 more
Products
Debian Linux Fedora Libarchive and 3 more
CVE-2021-34866

kernel: eBPF verification flaw

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel H300e H300e Firmware and 16 more
CVE-2020-7598

nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

CVSS 3.1 · 5.6 Medium EPSS 1.9% KEV · Not listed
Vendors
Opensuse Redhat Substack
Products
Leap Enterprise Linux Openshift and 6 more
CVE-2020-36327

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every "Dependency Confusion" issue in every product.

CVSS 3.1 · 8.8 High EPSS 6.3% KEV · Not listed
Vendors
Bundler Fedoraproject Microsoft and 1 more
Products
Bundler Fedora Package Manager Configurations and 4 more
CVE-2020-24513

hw: information disclosure on some Intel Atom processors

Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Intel Redhat and 1 more
Products
Debian Linux Atom C3308 Atom C3336 and 74 more
CVE-2020-24512

hw: observable timing discrepancy in some Intel Processors

Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Debian Intel Netapp and 1 more
Products
Debian Linux Microcode Fas\/aff Bios and 8 more
CVE-2020-24511

hw: improper isolation of shared resources in some Intel Processors

Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Intel Netapp and 1 more
Products
Debian Linux Microcode Fas\/aff Bios and 8 more
CVE-2020-1935

tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

CVSS 3.1 · 4.8 Medium EPSS 9.4% KEV · Not listed
Vendors
Apache Canonical Debian and 4 more
Products
Tomcat Ubuntu Linux Debian Linux and 22 more
CVE-2019-17563

tomcat: Session fixation when using FORM authentication

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

CVSS 3.1 · 7.5 High EPSS 10.7% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Tomcat Ubuntu Linux Debian Linux and 11 more
CVE-2018-1060

python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.

CVSS 3.1 · 7.5 High EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2024-35937

wifi: cfg80211: check A-MSDU format more carefully

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check A-MSDU format more carefully If it looks like there's another subframe in the A-MSDU but the header isn't fully there, we can end up reading data out of bounds, only to discard later. Make this a bit more careful and check if the subframe header can even be present.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 1 more
CVE-2024-9398

firefox: thunderbird: External protocol handlers could be enumerated via popups

By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Thunderbird Enterprise Linux and 5 more
CVE-2026-18922

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated successful bind, regardless of which SASL mechanism completes that second bind. An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. A variant using a valid low-privileged account's own successful bind instead of an anonymous one is also possible.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Directory Server Directory Server E4s Enterprise Linux and 8 more
CVE-2018-14647

python: Missing salt initialization in _elementtree.c module

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

CVSS 3.1 · 7.5 High EPSS 10.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more