Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,219

Export CSV
CVE-2017-14064

ruby: Arbitrary heap exposure during a JSON.generate call

Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.

CVSS 3.0 · 9.8 Critical EPSS 9.4% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 8 more
CVE-2017-5110

chromium-browser: ui spoofing in payments dialog

Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Apple Debian Google and 3 more
Products
Macos Debian Linux Android and 7 more
CVE-2017-13704

dnsmasq: Size parameter overflow via large DNS query

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.

CVSS 3.0 · 7.5 High EPSS 65.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2017-14491

dnsmasq: heap overflow in the code responsible for building DNS replies

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

CVSS 3.1 · 9.8 Critical EPSS 86.5% KEV · Not listed
Vendors
Arista Arubanetworks Canonical and 10 more
Products
Eos Arubaos Ubuntu Linux and 32 more
CVE-2017-14495

dnsmasq: memory exhaustion vulnerability in the EDNS0 code

Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service (memory consumption) via vectors involving DNS response creation.

CVSS 3.0 · 7.5 High EPSS 85.4% KEV · Not listed
Vendors
Canonical Debian Novell and 2 more
Products
Ubuntu Linux Debian Linux Leap and 5 more
CVE-2017-13086

wpa_supplicant: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13084

wpa_supplicant: reinstallation of the STK key in the PeerKey handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 9 more
CVE-2017-13087

wpa_supplicant: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame

Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13081

wpa_supplicant: Reinstallation of the integrity group key in the group key handshake

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 9 more
CVE-2017-13080

wpa_supplicant: Reinstallation of the group key in the group key handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13082

wpa_supplicant: Accepting a retransmitted FT Reassociation Request and reinstalling the pairwise key while processing it

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 8.1 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13088

wpa_supplicant: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame

Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-14496

dnsmasq: integer underflow leading to buffer over-read in the EDNS0 code

Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service via a crafted DNS request.

CVSS 3.0 · 7.5 High EPSS 68.4% KEV · Not listed
Vendors
Canonical Debian Google and 3 more
Products
Ubuntu Linux Debian Linux Android and 6 more
CVE-2017-13077

wpa_supplicant: Reinstallation of the pairwise key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13078

wpa_supplicant: Reinstallation of the group key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-12613

apr: Out-of-bounds array deref in apr_time_exp*() functions

When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.

CVSS 3.1 · 7.1 High EPSS 1.7% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Portable Runtime Debian Linux Enterprise Linux and 14 more
CVE-2017-12159

keycloak: CSRF token fixation

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Keycloak Redhat
Products
Keycloak Enterprise Linux Server Jboss Single Sign On and 2 more
CVE-2017-12629

Solr: Code execution via entity expansion

Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.

CVSS 3.1 · 9.8 Critical EPSS 92.5% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Solr Ubuntu Linux Debian Linux and 6 more