Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,088

Export CSV
CVE-2021-46661

mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE)

MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Mariadb Redhat
Products
Fedora Mariadb Enterprise Linux and 1 more
CVE-2021-46658

mariadb: save_window_function_values triggers an abort during IN subquery

save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_window_func=true for a subquery.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mariadb Redhat
Products
Mariadb Enterprise Linux Rhel Eus and 1 more
CVE-2021-46657

mariadb: Crash in get_sort_by_table() in subquery with ORDER BY having outer ref

get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mariadb Redhat
Products
Mariadb Enterprise Linux Rhel Eus and 1 more
CVE-2021-45930

qt: out-of-bounds write may lead to DoS

Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend (called from QPainterPath::addPath and QPathClipper::intersect).

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Fedoraproject Qt and 1 more
Products
Debian Linux Fedora Qtsvg and 1 more
CVE-2021-45485

kernel: information leak in the IPv6 implementation

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Linux Netapp Oracle and 1 more
Products
Linux Kernel Aff A400 Aff A400 Firmware and 43 more
CVE-2021-45482

webkitgtk: use-after-free in WebCore::ContainerNode::firstChild

In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different vulnerability than CVE-2021-30889.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat Webkitgtk
Products
Enterprise Linux Rhel Els Webkitgtk
CVE-2021-45481

webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create

In WebKitGTK before 2.32.4, there is incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create, leading to a segmentation violation and application crash, a different vulnerability than CVE-2021-30889.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat Webkitgtk
Products
Enterprise Linux Rhel Els Webkitgtk
CVE-2021-45444

zsh: Prompt expansion vulnerability

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 2 more
Products
Mac Os X Macos Debian Linux and 3 more
CVE-2021-45417

aide: heap-based buffer overflow on outputs larger than B64_BUF

AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Advanced Intrusion Detection Environment Project Canonical Debian and 2 more
Products
Advanced Intrusion Detection Environment Ubuntu Linux Debian Linux and 8 more
CVE-2021-45078

binutils: out-of-bounds write in stab_xcoff_builtin_type() in stabs.c

stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed
Vendors
Debian Fedoraproject Gnu and 2 more
Products
Debian Linux Fedora Binutils and 2 more
CVE-2021-44964

lua: use after free allows Sandbox Escape

Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Lua Redhat
Products
Lua Enterprise Linux Rhel Eus
CVE-2021-44733

kernel: use-after-free in the TEE subsystem

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 17 more
CVE-2021-44717

golang: syscall: don't close fd 0 on ForkExec error

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

CVSS 3.1 · 4.8 Medium EPSS 2.0% KEV · Not listed
Vendors
Debian Golang Opengroup and 1 more
Products
Debian Linux Go Unix and 7 more
CVE-2021-44716

golang: net/http: limit growth of header canonicalization cache

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

CVSS 3.1 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Cloud Insights Telegraf and 13 more
CVE-2021-44648

gdk-pixbuf: heap-buffer overflow when decoding the lzw compressed stream of image data

GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Debian Fedoraproject Gnome and 1 more
Products
Debian Linux Fedora Gdkpixbuf and 1 more
CVE-2021-44269

wavpack: Heap out-of-bounds read in WavpackPackSamples()

An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Redhat Wavpack
Products
Fedora Enterprise Linux Wavpack
CVE-2021-44227

mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Gnu Redhat
Products
Debian Linux Mailman Enterprise Linux and 2 more