Export limit exceeded: 425865 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,086

Export CSV
CVE-2018-8034

tomcat: Host name verification missing in WebSocket client

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

CVSS 3.1 · 7.5 High EPSS 21.0% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Tomcat Ubuntu Linux Debian Linux and 5 more
CVE-2018-7858

QEMU: cirrus: OOB access when updating VGA display

Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Opensuse Qemu and 1 more
Products
Ubuntu Linux Leap Qemu and 8 more
CVE-2018-7757

kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c

Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Extras Rt
CVE-2018-7755

kernel: Information exposure in fd_locked_ioctl function in drivers/block/floppy.c

An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 1 more
CVE-2018-7750

python-paramiko: Authentication bypass in transport.py

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

CVSS 3.1 · 9.8 Critical EPSS 27.1% KEV · Not listed
Vendors
Debian Paramiko Redhat
Products
Debian Linux Paramiko Ansible Engine and 15 more
CVE-2018-7740

kernel: Denial of service in resv_map_release function in mm/hugetlb.c

The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (BUG) via a crafted application that makes mmap system calls and has a large pgoff argument to the remap_file_pages system call.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 6 more
CVE-2018-7730

exempi: Heap-based buffer overflow in PSD_MetaHandler::CacheFileData function in XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp allows for denial of service via crafted XLS file

An issue was discovered in Exempi through 2.4.4. A certain case of a 0xffffffff length is mishandled in XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp, leading to a heap-based buffer over-read in the PSD_MetaHandler::CacheFileData() function.

CVSS 3.0 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Debian Exempi Project and 1 more
Products
Ubuntu Linux Debian Linux Exempi and 1 more
CVE-2018-7643

binutils: Integer overflow in the display_debug_ranges function resulting in crash

The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump.

CVSS 3.0 · 7.8 High EPSS 2.3% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux Enterprise Linux Desktop and 2 more
CVE-2018-7642

binutils: NULL pointer dereference in swap_std_reloc_in function in aoutx.h resulting in crash

The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy.

CVSS 3.0 · 5.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux Enterprise Linux Desktop and 2 more
CVE-2018-7584

php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing HTTP response

In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.

CVSS 3.0 · 9.8 Critical EPSS 87.3% KEV · Not listed
Vendors
Canonical Debian Php and 1 more
Products
Ubuntu Linux Debian Linux Php and 2 more
CVE-2018-7569

binutils: integer underflow or overflow via an ELF file with a corrupt DWARF FORM block in libbfd library

dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer underflow or overflow, and application crash) via an ELF file with a corrupt DWARF FORM block, as demonstrated by nm.

CVSS 3.0 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux Enterprise Linux Desktop and 2 more
CVE-2018-7568

binutils: integer overflow via an ELF file with corrupt dwarf1 debug information in libbfd library

The parse_die function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm.

CVSS 3.0 · 5.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Gnu Redhat
Products
Binutils Enterprise Linux Enterprise Linux Desktop and 2 more
CVE-2018-7566

kernel: race condition in snd_seq_write() may lead to UAF or OOB-access

The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 13 more
CVE-2018-7550

QEMU: i386: multiboot OOB access while loading kernel image

The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 8 more
CVE-2018-7485

unixODBC: Insecure buffer copy in SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c

The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.

CVSS 3.0 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Redhat Unixodbc
Products
Enterprise Linux Rhel Eus Unixodbc
CVE-2018-7456

libtiff: NULL pointer dereference in tif_print.c:TIFFPrintDirectory() causes a denial of service

A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)

CVSS 3.0 · 6.5 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Libtiff and 1 more
Products
Ubuntu Linux Debian Linux Libtiff and 1 more
CVE-2018-7418

wireshark: SIGCOMP dissector crash in packet-sigcomp.c

In Wireshark 2.2.0 to 2.2.12 and 2.4.0 to 2.4.4, the SIGCOMP dissector could crash. This was addressed in epan/dissectors/packet-sigcomp.c by correcting the extraction of the length value.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Debian Redhat Wireshark
Products
Debian Linux Enterprise Linux Wireshark
CVE-2018-7409

unixODBC: Buffer overflow in unicode_to_ansi_copy() can lead to crash or other unspecified impact

In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.

CVSS 3.0 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Redhat Unixodbc
Products
Enterprise Linux Rhel Eus Unixodbc
CVE-2018-7263

libmad: Double-free in the mad_decoder_run() function

The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552.

CVSS 3.0 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Redhat Underbit
Products
Enterprise Linux Libmad