Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 67

Export CSV
CVE-2013-1813

busybox: insecure directory permissions in /dev

util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Busybox Redhat T-mobile
Products
Busybox Enterprise Linux Tm-ac1900
CVE-2023-42363

busybox: use-after-free in awk

A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox
Products
Busybox
CVE-2021-42377

busybox: an attacker-controlled pointer free in hush applet leads to denial of service and possible code execution when processing a crafted shell command

An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.

CVSS 3.1 · 9.8 Critical EPSS 3.6% KEV · Not listed
Vendors
Busybox Fedoraproject Netapp
Products
Busybox Fedora Cloud Backup and 16 more
CVE-2021-42376

busybox: NULL pointer dereference in hush applet leads to denial of service when processing a crafted shell command

A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Fedoraproject Netapp
Products
Busybox Fedora Cloud Backup and 16 more
CVE-2021-42373

busybox: NULL pointer dereference in man applet leads to denial of service when a section name is supplied but no page argument is given

A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Fedoraproject Netapp
Products
Busybox Fedora Cloud Backup and 16 more
CVE-2017-3209

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem read/write permissions to the anonymous user. A remote user within range of the open access point on the drone may utilize the anonymous user of the FTP server to read arbitrary files, such as images and video recorded by the device, or to replace system files such as /etc/shadow to gain further access to the device. Furthermore, the DBPOWER U818A WIFI quadcopter drone uses BusyBox 1.20.2, which was released in 2012, and may be vulnerable to other known BusyBox vulnerabilities.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed
Vendors
Busybox Dbpower
Products
Busybox U818a U818a Firmware
CVE-2015-9261

busybox: Segmentation fault when unzipping specially crafted zip file

huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.

CVSS 3.1 · 5.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Busybox Canonical Debian
Products
Busybox Ubuntu Linux Debian Linux