Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2020-28493

Regular Expression Denial of Service (ReDoS)

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

CVSS 3.1 · 5.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Fedoraproject Palletsprojects Redhat
Products
Fedora Jinja Enterprise Linux and 1 more
CVE-2020-26137

python-urllib3: CRLF injection via HTTP request method

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Communications Cloud Native Core Network Function Cloud Native Environment and 5 more
CVE-2020-25696

postgresql: psql's \gset allows overwriting specially treated variables

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 3 more
CVE-2020-25695

postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.8 High EPSS 46.4% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 3 more
CVE-2020-25694

postgresql: Reconnection can downgrade connection security settings

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 3 more
CVE-2020-25613

ruby: Potential HTTP request smuggling in WEBrick

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Fedoraproject Redhat Ruby-lang
Products
Fedora Enterprise Linux Rhel E4s and 4 more
CVE-2020-1927

httpd: mod_rewrite configurations vulnerable to open redirect

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

CVSS 3.1 · 6.1 Medium EPSS 56.7% KEV · Not listed
Vendors
Apache Broadcom Canonical and 6 more
Products
Http Server Brocade Fabric Operating System Ubuntu Linux and 14 more
CVE-2020-1720

postgresql: ALTER ... DEPENDS ON EXTENSION is missing authorization checks

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

CVSS 3.1 · 3.1 Low EPSS 1.2% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Decision Manager Enterprise Linux and 5 more
CVE-2020-15366

nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

CVSS 3.1 · 5.6 Medium EPSS 2.3% KEV · Not listed
Vendors
Ajv.js Redhat
Products
Ajv Ansible Automation Platform Enterprise Linux and 3 more
CVE-2020-15180

mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and availability. This flaw affects mariadb versions before 10.1.47, before 10.2.34, before 10.3.25, before 10.4.15 and before 10.5.6.

CVSS 3.1 · 9.0 Critical EPSS 5.3% KEV · Not listed
Vendors
Debian Galeracluster Mariadb and 2 more
Products
Debian Linux Galera Cluster For Mysql Mariadb and 6 more
CVE-2020-15095

Sensitive information exposure through logs in npm cli

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Npmjs Opensuse and 1 more
Products
Fedora Npm Leap and 3 more
CVE-2020-14893

mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 2.1% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Enterprise Linux Rhel Software Collections
CVE-2020-14891

mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 2.3% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Enterprise Linux Rhel Software Collections
CVE-2020-14888

mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 2.3% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Enterprise Linux Rhel Software Collections
CVE-2020-14873

mysql: Server: Logging unspecified vulnerability (CPU Oct 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). Supported versions that are affected are 8.0.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.4 Medium EPSS 2.2% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Enterprise Linux Rhel Software Collections
CVE-2020-14870

mysql: Server: X Plugin unspecified vulnerability (CPU Oct 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 2.3% KEV · Not listed
Vendors
Oracle Redhat
Products
Mysql Enterprise Linux Rhel Software Collections
CVE-2020-14868

mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 2.0% KEV · Not listed
Vendors
Netapp Oracle Redhat
Products
Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 4 more
CVE-2020-14867

mysql: Server: DDL unspecified vulnerability (CPU Oct 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.4 Medium EPSS 1.9% KEV · Not listed
Vendors
Netapp Oracle Redhat
Products
Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 4 more