Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,468

Export CSV
CVE-2018-14467

tcpdump: Buffer over-read in bgp_capabilities_print() in print-bgp.c

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Mac Os X Debian Linux Fedora and 3 more
CVE-2024-28180

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

CVSS 3.1 · 4.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Go-jose Project Redhat
Products
Fedora Go-jose Acm and 12 more
CVE-2018-16451

tcpdump: Buffer over-read in print_trans() function in print-smb.c

The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN.

CVSS 3.1 · 9.8 Critical EPSS 4.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Mac Os X Debian Linux Fedora and 3 more
CVE-2018-16230

tcpdump: Buffer over-read in bgp_attr_print() function in print-bgp.c

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Mac Os X Debian Linux Fedora and 3 more
CVE-2018-16228

tcpdump: Access to uninitialized buffer in print_prefix() function in print-hncp.c

The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Mac Os X Debian Linux Fedora and 3 more
CVE-2020-27827

lldp/openvswitch: denial of service via externally triggered memory leak

A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Fedoraproject Lldpd Project Openvswitch and 2 more
Products
Fedora Lldpd Openvswitch and 25 more
CVE-2019-15165

libpcap: Resource exhaustion during PHB header length validation

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Ipados Iphone Os Mac Os X and 9 more
CVE-2024-34069

Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.

CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Debian Fedoraproject Palletsprojects and 1 more
Products
Debian Linux Fedora Werkzeug and 4 more
CVE-2021-33285

ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value in MFT records

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records proceeds into the wild.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Advanced Virtualization and 2 more
CVE-2021-3448

dnsmasq: fixed outgoing port used when --server is used with an interface name

A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.

CVSS 3.1 · 4 Medium EPSS 2.3% KEV · Not listed
Vendors
Fedoraproject Oracle Redhat and 1 more
Products
Fedora Communications Cloud Native Core Network Function Cloud Native Environment Enterprise Linux and 1 more
CVE-2021-39254

ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize()

A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resize, in NTFS-3G < 2021.8.22.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Advanced Virtualization and 2 more
CVE-2024-28184

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Kozea
Products
Fedora Weasyprint
CVE-2023-3341

A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly

The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Debian Fedoraproject Isc and 1 more
Products
Debian Linux Fedora Bind and 6 more
CVE-2023-2603

libcap: Integer Overflow in _libcap_strdup()

A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libcap Project and 1 more
Products
Debian Linux Fedora Libcap and 2 more