Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,250

Export CSV
CVE-2009-0065

kernel: sctp: memory overflow when FWD-TSN chunk is received with bad stream ID

Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.28-git8 allows remote attackers to have an unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk with a large stream ID.

CVSS 2.0 · 10.0 Critical EPSS 16.7% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2007-5966

kernel: non-root can trigger cpu_idle soft lockup

Integer overflow in the hrtimer_start function in kernel/hrtimer.c in the Linux kernel before 2.6.23.10 allows local users to execute arbitrary code or cause a denial of service (panic) via a large relative timeout value. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2008-5300

kernel: fix soft lockups/OOM issues with unix socket garbage collector

Linux kernel 2.6.28 allows local users to cause a denial of service ("soft lockup" and process loss) via a large number of sendmsg function calls, which does not block during AF_UNIX garbage collection and triggers an OOM condition, a different vulnerability than CVE-2008-5029.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2008-5182

kernel: fix inotify watch removal/umount races

The inotify functionality in Linux kernel 2.6 before 2.6.28-rc5 might allow local users to gain privileges via unknown vectors related to race conditions in inotify watch removal and umount.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2008-5079

Linux Kernel 'atm module' Local Denial of Service

net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8 and earlier allows local users to cause a denial of service (kernel infinite loop) by making two calls to svc_listen for the same socket, and then reading a /proc/net/atm/*vc file, related to corruption of the vcc table.

CVSS 2.0 · 4.9 Medium EPSS 1.1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2008-5029

kernel: Unix sockets kernel panic

The __scm_destroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and earlier makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service (panic) via vectors related to sending an SCM_RIGHTS message through a UNIX domain socket and closing file descriptors.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more
CVE-2008-3844

security flaw

Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact. NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points. As of 20080827, no unofficial distributions of this software are known.

CVSS 2.0 · 9.3 Critical EPSS 2.7% KEV · Not listed
Vendors
Openbsd Redhat
Products
Openssh Enterprise Linux Enterprise Linux Desktop and 1 more
CVE-2008-2933

Firefox command line URL launches multi-tabs

Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' (pipe) characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely handled by a vector application, as exploited in conjunction with CVE-2008-2540. NOTE: this issue exists because of an insufficient fix for CVE-2005-2267.

CVSS 2.0 · 2.6 Low EPSS 2.8% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Enterprise Linux Rhel Eus
CVE-2007-6015

samba: send_mailslot() buffer overflow

Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled, allows remote attackers to execute arbitrary code via a GETDC mailslot request composed of a long GETDC string following an offset username in a SAMLOGON logon request.

CVSS 2.0 · 9.3 Critical EPSS 27.5% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Rhel Eus Samba
CVE-2008-0003

tog-pegasus pam authentication buffer overflow

Stack-based buffer overflow in the PAMBasicAuthenticator::PAMCallback function in OpenPegasus CIM management server (tog-pegasus), when compiled to use PAM and without PEGASUS_USE_PAM_STANDALONE_PROC defined, might allow remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2007-5360.

CVSS 2.0 · 10.0 Critical EPSS 7.8% KEV · Not listed
Vendors
Openpegasus Redhat
Products
Management Server Enterprise Linux Enterprise Linux Desktop and 1 more
CVE-2008-2785

mozilla: CSS reference counter overflow (ZDI-CAN-349)

Mozilla Firefox before 2.0.0.16 and 3.x before 3.0.1, Thunderbird before 2.0.0.16, and SeaMonkey before 1.1.11 use an incorrect integer data type as a CSS object reference counter in the CSSValue array (aka nsCSSValue:Array) data structure, which allows remote attackers to execute arbitrary code via a large number of references to a common CSS object, leading to a counter overflow and a free of in-use memory, aka ZDI-CAN-349.

CVSS 2.0 · 9.3 Critical EPSS 5.3% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Seamonkey Thunderbird and 2 more
CVE-2008-2292

net-snmp: buffer overflow in perl module's Perl Module __snprint_value()

Buffer overflow in the __snprint_value function in snmp_get in Net-SNMP 5.1.4, 5.2.4, and 5.4.1, as used in SNMP.xs for Perl, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large OCTETSTRING in an attribute value pair (AVP).

CVSS 2.0 · 6.8 Medium EPSS 8.4% KEV · Not listed
Vendors
Net-snmp Redhat
Products
Net-snmp Enterprise Linux Rhel Eus
CVE-2008-1108

evolution: iCalendar buffer overflow via large timezone specification

Buffer overflow in Evolution 2.22.1, when the ITip Formatter plugin is disabled, allows remote attackers to execute arbitrary code via a long timezone string in an iCalendar attachment.

CVSS 2.0 · 7.6 High EPSS 5.7% KEV · Not listed
Vendors
Gnome Redhat
Products
Evolution Enterprise Linux Rhel Eus
CVE-2008-0960

net-snmp SNMPv3 authentication bypass (VU#877044)

SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2; (6) SNMP Research before 16.2; (7) multiple Cisco IOS, CatOS, ACE, and Nexus products; (8) Ingate Firewall 3.1.0 and later and SIParator 3.1.0 and later; (9) HP OpenView SNMP Emanate Master Agent 15.x; and possibly other products relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte.

CVSS 2.0 · 10.0 Critical EPSS 68.8% KEV · Not listed
Vendors
Cisco Ecos Sourceware Ingate and 4 more
Products
Ace 10 6504 Bundle With 4 Gbps Throughput Ace 10 6509 Bundle With 8 Gbps Throughput Ace 10 Service Module and 24 more
CVE-2008-0072

Evolution format string flaw

Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.

CVSS 2.0 · 6.8 Medium EPSS 6.0% KEV · Not listed
Vendors
Gnome Linux Redhat
Products
Evolution Linux Kernel Enterprise Linux and 1 more
CVE-2008-0063

krb5: possible leak of sensitive data from krb5kdc using krb4 request

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Mac Os X Mac Os X Server Ubuntu Linux and 10 more
CVE-2008-0062

krb5: uninitialized pointer use in krb5kdc

KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.

CVSS 3.1 · 9.8 Critical EPSS 10.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2014-6271

bash: specially-crafted environment variables can be used to inject shell commands

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

CVSS 3.1 · 9.8 Critical EPSS 100.0% KEV · Listed
Vendors
Apple Arista Canonical and 14 more
Products
Mac Os X Eos Ubuntu Linux and 87 more
CVE-2013-2094

kernel: perf_swevent_enabled array out-of-bound access

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.

CVSS 3.1 · 8.4 High EPSS 47.7% KEV · Listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 1 more