Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 137

Export CSV
CVE-2019-2436

mysql: Server: Replication unspecified vulnerability (CPU Jan 2019)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

CVSS 3.1 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Netapp Oracle Redhat
Products
Oncommand Unified Manager Oncommand Workflow Automation Snapcenter and 8 more
CVE-2019-2434

mysql: Server: Parser unspecified vulnerability (CPU Jan 2019)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 6.5 Medium EPSS 3.3% KEV · Not listed
Vendors
Canonical Netapp Oracle and 1 more
Products
Ubuntu Linux Oncommand Unified Manager Oncommand Workflow Automation and 9 more
CVE-2019-2420

mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2019)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.24 and prior and 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Netapp Oracle and 1 more
Products
Ubuntu Linux Oncommand Unified Manager Oncommand Workflow Automation and 9 more
CVE-2019-17570

xmlrpc: Deserialization of server-side exception from faultCause in XMLRPC error response

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

CVSS 3.1 · 9.8 Critical EPSS 49.3% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Xml-rpc Ubuntu Linux Debian Linux and 5 more
CVE-2019-11042

heap-buffer-overflow on exif_process_user_comment in EXIF extension

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

CVSS 3.1 · 7.1 High EPSS 4.4% KEV · Not listed
Vendors
Apple Canonical Debian and 4 more
Products
Mac Os X Ubuntu Linux Debian Linux and 6 more
CVE-2019-11041

heap-buffer-overflow on exif_scan_thumbnail in EXIF extension

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

CVSS 3.1 · 7.1 High EPSS 4.4% KEV · Not listed
Vendors
Apple Canonical Debian and 4 more
Products
Mac Os X Ubuntu Linux Debian Linux and 6 more
CVE-2019-11040

Heap buffer overflow in EXIF extension

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

CVSS 3.1 · 9.1 Critical EPSS 4.1% KEV · Not listed
Vendors
Debian Opensuse Php and 1 more
Products
Debian Linux Leap Php and 3 more
CVE-2019-11039

Out-of-bounds read in iconv.c

Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

CVSS 3.1 · 9.1 Critical EPSS 3.1% KEV · Not listed
Vendors
Debian Opensuse Php and 1 more
Products
Debian Linux Leap Php and 3 more
CVE-2019-11038

Uninitialized read in gdImageCreateFromXbm

When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized variable. This may lead to disclosing contents of the stack that has been left there by previous code.

CVSS 3.1 · 5.3 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2019-11036

Heap over-read in PHP EXIF extension

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

CVSS 3.1 · 9.1 Critical EPSS 7.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2019-11035

Heap over-read in PHP EXIF extension

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.

CVSS 3.1 · 9.1 Critical EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Netapp and 3 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 5 more
CVE-2019-11034

Heap over-read in PHP EXIF extension

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

CVSS 3.1 · 9.1 Critical EPSS 4.1% KEV · Not listed
Vendors
Canonical Debian Netapp and 3 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 5 more
CVE-2019-10196

nodejs-http-proxy-agent: Denial of Service and data leak due to improper buffer sanitization

A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Http-proxy-agent Project Redhat
Products
Fedora Http-proxy-agent Enterprise Linux and 1 more
CVE-2019-10192

redis: Heap buffer overflow in HyperLogLog triggered by malicious client

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.

CVSS 3.1 · 7.2 High EPSS 25.6% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Communications Operations Monitor and 9 more
CVE-2014-4650

python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

CVSS 3.1 · 9.8 Critical EPSS 23.9% KEV · Not listed
Vendors
Python Redhat
Products
Python Enterprise Linux Rhel Software Collections and 1 more
CVE-2013-5123

python-pip: insecure software download with mirroring support

The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.

CVSS 3.1 · 5.9 Medium EPSS 8.0% KEV · Not listed
Vendors
Debian Fedoraproject Pypa and 2 more
Products
Debian Linux Fedora Pip and 3 more