Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2021-31808

squid: integer overflow in HTTP Range header

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this.

CVSS 3.1 · 6.5 Medium EPSS 5.3% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 2 more
Products
Debian Linux Fedora Cloud Manager and 2 more
CVE-2021-31807

squid: incorrect memory management in HTTP Range header

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent.

CVSS 3.1 · 6.5 Medium EPSS 15.6% KEV · Not listed
Vendors
Fedoraproject Netapp Redhat and 1 more
Products
Fedora Cloud Manager Enterprise Linux and 1 more
CVE-2021-31806

squid: improper input validation in HTTP Range header

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing.

CVSS 3.1 · 6.5 Medium EPSS 95.3% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 2 more
Products
Debian Linux Fedora Cloud Manager and 2 more
CVE-2021-31535

libX11: missing request length checks

LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session.

CVSS 3.1 · 9.8 Critical EPSS 10.4% KEV · Not listed
Vendors
Fedoraproject Redhat X.org
Products
Fedora Ansible Automation Platform Enterprise Linux and 2 more
CVE-2021-31525

golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

CVSS 3.1 · 5.9 Medium EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Advanced Cluster Security and 8 more
CVE-2021-31440

kernel: local escalation of privileges in handling of eBPF programs

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-13661.

CVSS 3.1 · 7.0 High EPSS 1.8% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Cloud Backup H300e and 16 more
CVE-2021-31292

exiv2: Integer overflow in CrwMap:encode0x1810 leading to heap-based buffer overflow and DoS

An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of service (DOS) via crafted metadata.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Debian Exiv2 Fedoraproject and 1 more
Products
Debian Linux Exiv2 Fedora and 1 more
CVE-2021-30984

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

A race condition was addressed with improved state handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 1 more
Products
Ipados Iphone Os Macos and 7 more
CVE-2021-30954

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 1 more
Products
Ipados Iphone Os Macos and 7 more
CVE-2021-30953

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 1 more
Products
Ipados Iphone Os Macos and 7 more
CVE-2021-30951

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 1 more
Products
Ipados Iphone Os Macos and 7 more
CVE-2021-30936

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 1 more
Products
Ipados Iphone Os Macos and 7 more
CVE-2021-30934

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 1 more
Products
Ipados Iphone Os Macos and 7 more
CVE-2021-30897

webkitgtk: Cross-origin data exfiltration via resource timing API

An issue existed in the specification for the resource timing API. The specification was updated and the updated specification was implemented. This issue is fixed in macOS Monterey 12.0.1. A malicious website may exfiltrate data cross-origin.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Apple Redhat
Products
Ipados Iphone Os Macos and 3 more
CVE-2021-30890

webkitgtk: Logic issue leading to universal cross-site scripting

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to universal cross site scripting.

CVSS 3.1 · 6.1 Medium EPSS 1.5% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 1 more
Products
Ipados Iphone Os Macos and 6 more
CVE-2021-30889

webkitgtk: Buffer overflow leading to arbitrary code execution

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Apple Redhat
Products
Ipados Iphone Os Macos and 4 more
CVE-2021-30888

webkitgtk: Information leak via Content Security Policy reports

An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content Security Policy reports may be able to leak information via redirect behavior .

CVSS 3.1 · 7.4 High EPSS 1.7% KEV · Not listed
Vendors
Apple Redhat
Products
Ipad Os Ipados Iphone Os and 5 more
CVE-2021-30887

webkitgtk: Logic issue leading to Content Security Policy bypass

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to unexpectedly unenforced Content Security Policy.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 1 more
Products
Ipados Iphone Os Macos and 6 more