Export limit exceeded: 425892 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2020-15811

squid: HTTP Request Splitting could result in cache poisoning

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.

CVSS 3.1 · 6.5 Medium EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2020-15810

squid: HTTP Request Smuggling could result in cache poisoning

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2020-15780

kernel: lockdown: bypass through ACPI write via acpi_configfs

An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.

CVSS 3.1 · 6.7 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Linux Opensuse and 1 more
Products
Ubuntu Linux Linux Kernel Leap and 3 more
CVE-2020-15720

pki: Dogtag's python client does not validate certificates

In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dogtagpki Redhat
Products
Dogtagpki Enterprise Linux
CVE-2020-15719

openldap: Certificate validation incorrectly matches name against CN-ID

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

CVSS 3.1 · 4.2 Medium EPSS 2.5% KEV · Not listed
Vendors
Mcafee Openldap Opensuse and 2 more
Products
Policy Auditor Openldap Leap and 2 more
CVE-2020-15707

GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.

CVSS 3.1 · 5.7 Medium EPSS 1.6% KEV · Not listed
Vendors
Canonical Debian Gnu and 5 more
Products
Ubuntu Linux Debian Linux Grub2 and 16 more
CVE-2020-15706

GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.

GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Gnu and 4 more
Products
Ubuntu Linux Debian Linux Grub2 and 15 more
CVE-2020-15705

GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.

CVSS 3.1 · 6.4 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Debian Gnu and 4 more
Products
Ubuntu Linux Debian Linux Grub2 and 15 more
CVE-2020-15683

Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4.

CVSS 3.1 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Debian Mozilla Opensuse and 1 more
Products
Debian Linux Firefox Firefox Esr and 5 more
CVE-2020-15678

Mozilla: When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free scenario

When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Debian Mozilla Opensuse and 1 more
Products
Debian Linux Firefox Firefox Esr and 5 more
CVE-2020-15677

Mozilla: Download origin spoofing via redirect

By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

CVSS 3.1 · 6.1 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Mozilla Opensuse and 1 more
Products
Debian Linux Firefox Firefox Esr and 5 more
CVE-2020-15676

Mozilla: XSS when pasting attacker-controlled data into a contenteditable element

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

CVSS 3.1 · 6.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Mozilla Opensuse and 1 more
Products
Debian Linux Firefox Firefox Esr and 5 more
CVE-2020-15673

Mozilla: Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3

Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Debian Mozilla Opensuse and 1 more
Products
Debian Linux Firefox Firefox Esr and 5 more
CVE-2020-15669

Mozilla: Use-After-Free when aborting an operation

When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a use-after-free and we presume that with enough effort it could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.12 and Thunderbird < 68.12.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Esr Thunderbird Enterprise Linux and 2 more
CVE-2020-15659

Mozilla: Memory safety bugs fixed in Firefox 79 and Firefox ESR 68.11

Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.

CVSS 3.1 · 8.8 High EPSS 2.4% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Firefox Esr and 5 more
CVE-2020-15658

Mozilla: Overriding file type when saving to disk

The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Mozilla Redhat
Products
Ubuntu Linux Firefox Firefox Esr and 4 more
CVE-2020-15656

Mozilla: Type confusion for special arguments in IonMonkey

JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Canonical Mozilla Opensuse and 1 more
Products
Ubuntu Linux Firefox Firefox Esr and 5 more
CVE-2020-15654

Mozilla: Custom cursor can overlay user interface

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Mozilla Redhat
Products
Ubuntu Linux Firefox Firefox Esr and 4 more
CVE-2020-15653

Mozilla: Bypassing iframe sandbox when allowing popups

An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Mozilla Redhat
Products
Ubuntu Linux Firefox Firefox Esr and 4 more
CVE-2020-15652

Mozilla: Potential leak of redirect targets when loading scripts in a worker

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Canonical Mozilla Redhat
Products
Ubuntu Linux Firefox Firefox Esr and 4 more