CVE-2019-19054

kernel: A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c allows attackers to cause a DoS

A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering kfifo_alloc() failures, aka CID-a7b2df76b42b.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Broadcom Canonical Fedoraproject and 3 more

Products

Brocade Fabric Operating System Firmware Ubuntu Linux Fedora and 16 more

CVE-2019-17563

tomcat: Session fixation when using FORM authentication

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

CVSS 3.1 · 7.5 High EPSS 10.7% KEV · Not listed

Vendors

Apache Canonical Debian and 3 more

Products

Tomcat Ubuntu Linux Debian Linux and 11 more

CVE-2019-15219

kernel: null pointer dereference in drivers/usb/misc/sisusbvga/sisusb.c driver

An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/usb/misc/sisusbvga/sisusb.c driver.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 7 more

CVE-2019-15218

kernel: null pointer dereference in the drivers/media/usb/siano/smsusb.c driver

An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/siano/smsusb.c driver.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 8 more

CVE-2019-15217

kernel: null pointer dereference in drivers/media/usb/zr364xx/zr364xx.c driver

An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 3 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 9 more

CVE-2019-14250

binutils: integer overflow in simple-object-elf.c leads to a heap-based buffer overflow

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.

CVSS 3.1 · 5.5 Medium EPSS 2.3% KEV · Not listed

Vendors

Canonical Gnu Opensuse

Products

Ubuntu Linux Binutils Leap

CVE-2019-12418

tomcat: local privilege escalation

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.

CVSS 3.1 · 7.0 High EPSS 1.2% KEV · Not listed

Vendors

Apache Canonical Debian and 4 more

Products

Tomcat Ubuntu Linux Debian Linux and 4 more

CVE-2018-1000880

libarchive: Improper input validation in WARC parser resulting in a denial of service

libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.

CVSS 3.1 · 6.5 Medium EPSS 4.1% KEV · Not listed

Vendors

Canonical Fedoraproject Libarchive and 1 more

Products

Ubuntu Linux Fedora Libarchive and 1 more

CVE-2018-1000879

libarchive: NULL pointer dereference in ACL parser resulting in a denial of service

libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file.

CVSS 3.1 · 6.5 Medium EPSS 3.4% KEV · Not listed

Vendors

Fedoraproject Libarchive Opensuse

Products

Fedora Libarchive Leap

CVE-2018-1000802

python: Command injection in the shutil module

Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace.

CVSS 3.1 · 9.8 Critical EPSS 20.1% KEV · Not listed

Vendors

Canonical Debian Opensuse and 1 more

Products

Ubuntu Linux Debian Linux Leap and 1 more

CVE-2016-0718

expat: Out-of-bounds heap read on crafted input causing crash

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

CVSS 3.1 · 9.8 Critical EPSS 13.3% KEV · Not listed

Vendors

Apple Canonical Debian and 7 more

Products

Mac Os X Ubuntu Linux Debian Linux and 13 more

CVE-2019-5010

python: NULL pointer dereference using a specially crafted X509 certificate

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

CVSS 3.1 · 7.5 High EPSS 20.7% KEV · Not listed

Vendors

Debian Opensuse Python and 1 more

Products

Debian Linux Leap Python and 6 more

CVE-2018-14647

python: Missing salt initialization in _elementtree.c module

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.

CVSS 3.1 · 7.5 High EPSS 10.9% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 12 more

CVE-2015-3246

libuser: Security flaw in handling /etc/passwd file

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

CVSS 3.1 · 7.4 High EPSS 8.5% KEV · Listed

Vendors

Libuser Project Opensuse Redhat

Products

Libuser Opensuse Enterprise Linux

CVE-2026-31431

crypto: algif_aead - Revert to operating out-of-place

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CVSS 3.1 · 7.8 High EPSS 98.1% KEV · Listed

Vendors

Amazon Arista Canonical and 7 more

Products

Amazon Linux Cloudvision Agni Cloudvision Portal and 57 more

CVE-2020-8619

A buffer boundary check assertion in rdataset.c can fail incorrectly during zone transfer

In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.

CVSS 3.1 · 4.9 Medium EPSS 2.1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 4 more

CVE-2019-17569

tomcat: Regression in handling of Transfer-Encoding header allows for HTTP request smuggling

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

CVSS 3.1 · 4.8 Medium EPSS 8.9% KEV · Not listed

Vendors

Apache Debian Netapp and 3 more

Products

Tomcat Tomee Debian Linux and 14 more

CVE-2020-10683

dom4j: XML External Entity vulnerability in default SAX parser

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

CVSS 3.1 · 9.8 Critical EPSS 7.3% KEV · Not listed

Vendors

Canonical Dom4j Project Netapp and 3 more

Products

Ubuntu Linux Dom4j Oncommand Api Services and 41 more

CVE-2020-1938

tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

CVSS 3.1 · 9.8 Critical EPSS 99.3% KEV · Listed

Vendors

Apache Blackberry Debian and 5 more

Products

Geode Tomcat Good Control and 24 more

CVE-2019-11045

DirectoryIterator class silently truncates after a null byte

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

CVSS 3.1 · 3.7 Low EPSS 8.8% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 5 more