Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2020-26571

opensc: stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init

The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Opensc Project and 1 more
Products
Debian Linux Fedora Opensc and 1 more
CVE-2020-26541

kernel: security bypass in certs/blacklist.c and certs/system_keyring.c

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus and 1 more
CVE-2020-26154

libproxy: sending more than 102400 bytes in PAC without a Content-Length present could result in buffer overflow

url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header.

CVSS 3.1 · 9.8 Critical EPSS 3.6% KEV · Not listed
Vendors
Debian Fedoraproject Libproxy Project and 2 more
Products
Debian Linux Fedora Libproxy and 3 more
CVE-2020-26137

python-urllib3: CRLF injection via HTTP request method

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Oracle and 2 more
Products
Ubuntu Linux Debian Linux Communications Cloud Native Core Network Function Cloud Native Environment and 5 more
CVE-2020-26117

tigervnc: certificate exceptions stored as authorities

In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.

CVSS 3.1 · 8.1 High EPSS 3.1% KEV · Not listed
Vendors
Debian Opensuse Redhat and 1 more
Products
Debian Linux Leap Enterprise Linux and 1 more
CVE-2020-25743

QEMU: ide: null pointer dereference while cancelling i/o operation

hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack Platform
CVE-2020-25723

QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c

A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 2 more
CVE-2020-25719

samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

CVSS 3.1 · 7.2 High EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2020-25717

samba: Active Directory (AD) domain user could become root on domain members

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 25 more
CVE-2020-25715

pki-core: XSS in the certificate search results

A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity.

CVSS 3.1 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Dogtagpki Redhat
Products
Dogtagpki Enterprise Linux Rhel Eus
CVE-2020-25713

raptor2: malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common

A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common.

CVSS 3.1 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Debian Fedoraproject Librdf and 1 more
Products
Debian Linux Fedora Raptor Rdf Syntax Library and 1 more
CVE-2020-25712

xorg-x11-server: XkbSetDeviceInfo heap-based buffer overflow privilege escalation vulnerability

A flaw was found in xorg-x11-server before 1.20.10. A heap-buffer overflow in XkbSetDeviceInfo may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat X.org
Products
Enterprise Linux X Server
CVE-2020-25708

libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS

A divide by zero issue was found to occur in libvncserver-0.9.12. A malicious client could use this flaw to send a specially crafted message that, when processed by the VNC server, would lead to a floating point exception, resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Debian Libvncserver Project Redhat
Products
Debian Linux Libvncserver Enterprise Linux
CVE-2020-25705

kernel: ICMP rate limiting can be used for DNS poisoning attack

A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version

CVSS 3.1 · 7.4 High EPSS 6.7% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Aus and 4 more
CVE-2020-25704

kernel: perf_event_parse_addr_filter memory

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat and 1 more
Products
Debian Linux Linux Kernel Enterprise Linux and 6 more
CVE-2020-25696

postgresql: psql's \gset allows overwriting specially treated variables

A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating system account running psql. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 3 more
CVE-2020-25695

postgresql: Multiple features escape "security restricted operation" sandbox

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.8 High EPSS 46.4% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 3 more
CVE-2020-25694

postgresql: Reconnection can downgrade connection security settings

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 3 more
CVE-2020-25690

fontforge: SFD_GetFontMetaData() insufficient CVE-2020-5395 backport

An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. This flaw allows an attacker to manipulate the memory allocated on the heap, causing the application to crash or execute arbitrary code. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Fontforge Redhat
Products
Fontforge Enterprise Linux