Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 129

Export CSV
CVE-2020-25717

samba: Active Directory (AD) domain user could become root on domain members

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 25 more
CVE-2020-14301

libvirt: leak of sensitive cookie information via dumpxml

An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensitive information in the domain configuration via the `dumpxml` command.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat
Products
Ontap Select Deploy Administration Utility Advanced Virtualization Codeready Linux Builder and 11 more
CVE-2019-8383

advancecomp: denial of service in function adv_png_unfilter_8 in lib/png.c

An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Advancemame Debian Fedoraproject and 1 more
Products
Advancecomp Debian Linux Fedora and 4 more
CVE-2019-8379

advancecomp: null pointer dereference in function be_uint32_read() in endianrw.h

An issue was discovered in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Advancemame Debian Fedoraproject and 1 more
Products
Advancecomp Debian Linux Fedora and 4 more
CVE-2019-6454

systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

CVSS 3.1 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 23 more
CVE-2019-15718

systemd: systemd-resolved allows unprivileged users to configure DNS

In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Systemd Project
Products
Fedora Enterprise Linux Enterprise Linux Eus and 12 more
CVE-2018-16881

rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled

A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Debian Redhat Rsyslog
Products
Debian Linux Enterprise Linux Enterprise Linux Desktop and 11 more
CVE-2017-15129

kernel: net: double-free and memory corruption in get_net_ns_by_id()

A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Linux and 1 more
Products
Ubuntu Linux Fedora Linux Kernel and 19 more
CVE-2016-2124

samba: SMB1 client connections can be downgraded to plaintext authentication

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

CVSS 3.1 · 5.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 23 more