Export limit exceeded: 425894 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2020-2588

mysql: Server: DML unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Netapp Oracle and 1 more
Products
Ubuntu Linux Active Iq Unified Manager Oncommand Insight and 7 more
CVE-2020-2584

mysql: Server: Options unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Server accessible data. CVSS 3.0 Base Score 4.4 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).

CVSS 3.1 · 4.4 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Netapp Oracle and 1 more
Products
Ubuntu Linux Active Iq Unified Manager Oncommand Insight and 7 more
CVE-2020-2583

OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 3.7 Low EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Mcafee and 4 more
Products
Ubuntu Linux Debian Linux Epolicy Orchestrator and 24 more
CVE-2020-2579

mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Netapp Oracle and 1 more
Products
Ubuntu Linux Active Iq Unified Manager Oncommand Insight and 7 more
CVE-2020-2577

mysql: InnoDB unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Netapp Oracle and 1 more
Products
Ubuntu Linux Active Iq Unified Manager Oncommand Insight and 7 more
CVE-2020-2574

mysql: C API unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 5.9 Medium EPSS 3.5% KEV · Not listed
Vendors
Canonical Mariadb Netapp and 3 more
Products
Ubuntu Linux Mariadb Active Iq Unified Manager and 9 more
CVE-2020-2573

mysql: C API unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 5.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Canonical Netapp Oracle and 1 more
Products
Ubuntu Linux Active Iq Unified Manager Oncommand Insight and 7 more
CVE-2020-2570

mysql: C API unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 5.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Canonical Oracle Redhat
Products
Ubuntu Linux Mysql Enterprise Linux and 3 more
CVE-2020-29661

kernel: locking issue in drivers/tty/tty_jobctrl.c can lead to an use-after-free

A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 4 more
Products
Fabric Operating System Debian Linux Fedora and 22 more
CVE-2020-29660

kernel: locking inconsistency in drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c can lead to a read-after-free

A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID, aka CID-c8bcd9c5be24.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 3 more
Products
Fabric Operating System Debian Linux Fedora and 15 more
CVE-2020-29652

golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference

A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Golang Redhat
Products
Ssh Container Native Virtualization Enterprise Linux and 1 more
CVE-2020-29623

webkitgtk: User may be unable to fully delete browsing history

"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing history.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Apple Fedoraproject Redhat and 1 more
Products
Ipados Iphone Os Mac Os X and 6 more
CVE-2020-29599

ImageMagick: Shell injection via PDF password could result in arbitrary code execution

ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.

CVSS 3.1 · 7.8 High EPSS 7.5% KEV · Not listed
Vendors
Debian Imagemagick Redhat
Products
Debian Linux Imagemagick Enterprise Linux
CVE-2020-29368

kernel: the copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check

An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Cloud Backup Element Software and 8 more
CVE-2020-29130

QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets

slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Fedoraproject Libslirp Project and 1 more
Products
Debian Linux Fedora Libslirp and 1 more
CVE-2020-29129

QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets

ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

CVSS 3.1 · 4.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Libslirp Project and 1 more
Products
Debian Linux Fedora Libslirp and 1 more
CVE-2020-28974

kernel: slab-out-of-bounds read in fbcon

A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or potentially crash the kernel, aka CID-3c4e0dff2095. This occurs because KD_FONT_OP_COPY in drivers/tty/vt/vt.c can be used for manipulations such as font height.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux
CVE-2020-28948

Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

CVSS 3.1 · 7.8 High EPSS 47.5% KEV · Not listed
Vendors
Debian Drupal Fedoraproject and 2 more
Products
Debian Linux Drupal Fedora and 3 more
CVE-2020-28935

Local symlink attack in Unbound and NSD

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Nlnetlabs Redhat
Products
Debian Linux Name Server Daemon Unbound and 2 more