Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,842

Export CSV
CVE-2021-46790

ntfs-3g: heap-based buffer overflow in ntfsck

ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the upstream position is that ntfsck is deprecated; however, it is shipped by some Linux distributions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2021-46669

mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used

MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Debian Fedoraproject Mariadb and 1 more
Products
Debian Linux Fedora Mariadb and 2 more
CVE-2021-46668

mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements

MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Mariadb Redhat
Products
Fedora Mariadb Enterprise Linux and 1 more
CVE-2021-46665

mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations

MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Mariadb Redhat
Products
Fedora Mariadb Enterprise Linux and 1 more
CVE-2021-46664

mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr

MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Mariadb Redhat
Products
Fedora Mariadb Enterprise Linux and 1 more
CVE-2021-46661

mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE)

MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Mariadb Redhat
Products
Fedora Mariadb Enterprise Linux and 1 more
CVE-2021-45930

qt: out-of-bounds write may lead to DoS

Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend (called from QPainterPath::addPath and QPathClipper::intersect).

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Fedoraproject Qt and 1 more
Products
Debian Linux Fedora Qtsvg and 1 more
CVE-2021-45452

django: Potential directory-traversal via Storage.save()

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

CVSS 3.1 · 5.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Satellite and 1 more
CVE-2021-45444

zsh: Prompt expansion vulnerability

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 2 more
Products
Mac Os X Macos Debian Linux and 3 more
CVE-2021-45417

aide: heap-based buffer overflow on outputs larger than B64_BUF

AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Advanced Intrusion Detection Environment Project Canonical Debian and 2 more
Products
Advanced Intrusion Detection Environment Ubuntu Linux Debian Linux and 8 more
CVE-2021-45115

django: Denial-of-service possibility in UserAttributeSimilarityValidator

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Satellite and 1 more
CVE-2021-45078

binutils: out-of-bounds write in stab_xcoff_builtin_type() in stabs.c

stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed
Vendors
Debian Fedoraproject Gnu and 2 more
Products
Debian Linux Fedora Binutils and 2 more
CVE-2021-44733

kernel: use-after-free in the TEE subsystem

A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 17 more
CVE-2021-44648

gdk-pixbuf: heap-buffer overflow when decoding the lzw compressed stream of image data

GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Debian Fedoraproject Gnome and 1 more
Products
Debian Linux Fedora Gdkpixbuf and 1 more
CVE-2021-44420

django: potential bypass of an upstream access control based on URL paths

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.

CVSS 3.1 · 7.3 High EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 2 more
Products
Ubuntu Linux Debian Linux Django and 4 more
CVE-2021-44269

wavpack: Heap out-of-bounds read in WavpackPackSamples()

An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV files. This issue triggered in function WavpackPackSamples of file src/pack_utils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound.

CVSS 3.1 · 5.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Redhat Wavpack
Products
Fedora Enterprise Linux Wavpack
CVE-2021-44225

keepalived: dbus access control bypass

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Keepalived Redhat
Products
Fedora Keepalived Enterprise Linux