Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2019-20372

nginx: HTTP request smuggling in configurations with URL redirect used as error_page

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

CVSS 3.1 · 5.3 Medium EPSS 15.0% KEV · Not listed
Vendors
Apple Canonical F5 and 3 more
Products
Xcode Ubuntu Linux Nginx and 5 more
CVE-2019-1352

git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.

CVSS 3.1 · 8.8 High EPSS 24.0% KEV · Not listed
Vendors
Microsoft Redhat
Products
Visual Studio 2017 Visual Studio 2019 Enterprise Linux and 2 more
CVE-2019-1349

git: Recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.

CVSS 3.1 · 8.8 High EPSS 34.0% KEV · Not listed
Vendors
Microsoft Redhat
Products
Visual Studio 2017 Visual Studio 2019 Enterprise Linux and 2 more
CVE-2019-1348

git: Arbitrary path overwriting via export-marks in-stream command feature

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Git-scm Opensuse Redhat
Products
Git Leap Enterprise Linux and 2 more
CVE-2019-19330

haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka Intermediary Encapsulation Attacks.

CVSS 3.1 · 9.8 Critical EPSS 4.0% KEV · Not listed
Vendors
Canonical Debian Haproxy and 1 more
Products
Ubuntu Linux Debian Linux Haproxy and 3 more
CVE-2019-19246

oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c

Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c.

CVSS 3.1 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2019-19204

oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c

An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read.

CVSS 3.1 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Debian Fedoraproject Oniguruma Project and 1 more
Products
Debian Linux Fedora Oniguruma and 3 more
CVE-2019-19203

oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c

An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read.

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Fedoraproject Oniguruma Project Redhat
Products
Fedora Oniguruma Enterprise Linux and 2 more
CVE-2019-18874

python-psutil: Double free because of refcount mishandling

psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Psutil Project Redhat
Products
Psutil Ansible Tower Enterprise Linux and 4 more
CVE-2019-18277

haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated "chunked" value

A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).

CVSS 3.1 · 7.5 High EPSS 10.1% KEV · Not listed
Vendors
Haproxy Redhat
Products
Haproxy Enterprise Linux Openshift and 1 more
CVE-2019-17570

xmlrpc: Deserialization of server-side exception from faultCause in XMLRPC error response

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

CVSS 3.1 · 9.8 Critical EPSS 49.3% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Xml-rpc Ubuntu Linux Debian Linux and 5 more
CVE-2019-16777

Arbitrary File Overwrite in npm CLI

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

CVSS 3.1 · 7.7 High EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Npmjs Opensuse and 2 more
Products
Fedora Npm Leap and 5 more
CVE-2019-16776

Unauthorized File Access in npm CLI before before version 6.13.3

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

CVSS 3.1 · 7.7 High EPSS 3.4% KEV · Not listed
Vendors
Fedoraproject Npmjs Opensuse and 2 more
Products
Fedora Npm Leap and 5 more
CVE-2019-16775

Unauthorized File Access in npm CLI before before version 6.13.3

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

CVSS 3.1 · 7.7 High EPSS 2.9% KEV · Not listed
Vendors
Fedoraproject Npmjs Opensuse and 2 more
Products
Fedora Npm Leap and 5 more
CVE-2019-16255

ruby: Code injection via command argument of Shell#test / Shell#[]

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.

CVSS 3.1 · 8.1 High EPSS 4.2% KEV · Not listed
Vendors
Debian Opensuse Oracle and 2 more
Products
Debian Linux Leap Graalvm and 5 more
CVE-2019-16254

ruby: HTTP response splitting in WEBrick

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.

CVSS 3.1 · 5.3 Medium EPSS 4.6% KEV · Not listed
Vendors
Debian Redhat Ruby-lang
Products
Debian Linux Enterprise Linux Rhel E4s and 3 more
CVE-2019-16201

ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.

CVSS 3.1 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Debian Redhat Ruby-lang
Products
Debian Linux Enterprise Linux Rhel E4s and 3 more
CVE-2019-15892

varnish: denial of service handling certain crafted HTTP/1 requests

An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.

CVSS 3.0 · 7.5 High EPSS 5.9% KEV · Not listed
Vendors
Debian Redhat Varnish-software and 1 more
Products
Debian Linux Enterprise Linux Rhel Software Collections and 2 more
CVE-2019-11048

Temporary files are not cleaned after OOM when parsing HTTP request data

In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.

CVSS 3.1 · 5.3 Medium EPSS 6.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Software Collections