Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2019-9637

php: File rename across filesystems may allow unwanted access during processing

An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.

CVSS 3.0 · 7.5 High EPSS 7.3% KEV · Not listed
Vendors
Canonical Debian Netapp and 3 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 4 more
CVE-2019-9512

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVSS 3.1 · 7.5 High EPSS 83.4% KEV · Not listed
Vendors
Apache Apple Canonical and 3 more
Products
Traffic Server Mac Os X Swiftnio and 21 more
CVE-2019-9024

php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.

CVSS 3.0 · 7.5 High EPSS 7.1% KEV · Not listed
Vendors
Canonical Debian Netapp and 3 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 4 more
CVE-2019-9023

php: Heap-based buffer over-read in mbstring regular expression functions

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.

CVSS 3.0 · 9.8 Critical EPSS 9.3% KEV · Not listed
Vendors
Canonical Debian Netapp and 3 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 4 more
CVE-2019-9022

php: memcpy with negative length via crafted DNS response

An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.

CVSS 3.0 · 7.5 High EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Netapp and 2 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 3 more
CVE-2019-9021

php: Heap-based buffer over-read in PHAR reading functions

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.

CVSS 3.0 · 9.8 Critical EPSS 10.1% KEV · Not listed
Vendors
Canonical Debian Netapp and 3 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 4 more
CVE-2019-9020

php: Invalid memory access in function xmlrpc_decode()

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.

CVSS 3.0 · 9.8 Critical EPSS 10.1% KEV · Not listed
Vendors
Canonical Debian Netapp and 3 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 4 more
CVE-2019-8325

rubygems: Escape sequence injection vulnerability in errors

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Cloudforms Managementengine and 6 more
CVE-2019-8324

rubygems: Installing a malicious gem may lead to arbitrary code execution

An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.

CVSS 3.1 · 8.8 High EPSS 3.2% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Cloudforms Managementengine and 6 more
CVE-2019-8323

rubygems: Escape sequence injection vulnerability in API response handling

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Cloudforms Managementengine and 6 more
CVE-2019-8322

rubygems: Escape sequence injection vulnerability in gem owner

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Cloudforms Managementengine and 6 more
CVE-2019-8321

rubygems: Escape sequence injection vulnerability in verbose

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Cloudforms Managementengine and 6 more
CVE-2019-8320

rubygems: Delete directory using symlink when decompressing tar

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.

CVSS 3.0 · 7.4 High EPSS 4.2% KEV · Not listed
Vendors
Redhat Rubygems
Products
Cloudforms Managementengine Enterprise Linux Rhel Software Collections and 1 more
CVE-2019-6977

gd: Heap-based buffer overflow in gdImageColorMatch() in gd_color_match.c

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data.

CVSS 3.0 · 8.8 High EPSS 71.5% KEV · Not listed
Vendors
Canonical Debian Libgd and 3 more
Products
Ubuntu Linux Debian Linux Libgd and 4 more
CVE-2019-5737

nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass

In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.

CVSS 3.1 · 7.5 High EPSS 16.2% KEV · Not listed
Vendors
Nodejs Opensuse Redhat
Products
Node.js Leap Enterprise Linux and 1 more
CVE-2019-5419

rubygem-actionpack: denial of service vulnerability in Action View

There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.

CVSS 3.1 · 7.5 High EPSS 8.4% KEV · Not listed
Vendors
Debian Fedoraproject Opensuse and 2 more
Products
Debian Linux Fedora Leap and 5 more
CVE-2019-3881

rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code

Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Bundler Redhat
Products
Bundler Enterprise Linux Rhel Software Collections
CVE-2019-3878

mod_auth_mellon: authentication bypass in ECP flow

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

CVSS 3.0 · 8.1 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Fedoraproject Mod Auth Mellon Project and 1 more
Products
Ubuntu Linux Fedora Mod Auth Mellon and 8 more
CVE-2019-3018

mysql: InnoDB unspecified vulnerability (CPU Oct 2019)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.17 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.4 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Fedoraproject Netapp and 2 more
Products
Ubuntu Linux Fedora Active Iq Unified Manager and 8 more
CVE-2019-3011

mysql: Server: C API unspecified vulnerability (CPU Oct 2019)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: C API). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Canonical Fedoraproject Netapp and 2 more
Products
Ubuntu Linux Fedora Active Iq Unified Manager and 8 more