Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,935

Export CSV
CVE-2018-1139

samba: Weak authentication protocol regression

A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.

CVSS 3.1 · 8.1 High EPSS 3.1% KEV · Not listed
Vendors
Canonical Redhat Samba
Products
Ubuntu Linux Enterprise Linux Enterprise Linux Desktop and 4 more
CVE-2018-1130

kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash

Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit() function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of certain crafted system calls.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 5 more
CVE-2018-1129

ceph: cephx uses weak signatures

A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

CVSS 3.0 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Ceph Debian Opensuse and 1 more
Products
Ceph Debian Linux Leap and 7 more
CVE-2018-1128

ceph: cephx protocol is vulnerable to replay attack

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

CVSS 3.0 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Debian Opensuse Redhat
Products
Debian Linux Leap Ceph and 7 more
CVE-2018-1120

kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service

A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks).

CVSS 3.0 · 2.8 Low EPSS 7.1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 10 more
CVE-2018-1118

kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg()

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

CVSS 3.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 6 more
CVE-2018-1113

setup: nologin listed in /etc/shells violates security expectations

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pam_shells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users which had their shell changed to /sbin/nologin could still access the system.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2018-1111

dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.

CVSS 3.0 · 7.5 High EPSS 97.9% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 8 more
CVE-2018-1106

PackageKit: authentication bypass allows to install signed packages without administrator privileges

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Packagekit Project and 1 more
Products
Ubuntu Linux Debian Linux Packagekit and 7 more
CVE-2018-1100

zsh: buffer overflow in utils.c:checkmailpath() can lead to local arbitrary code execution

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Redhat Zsh
Products
Ubuntu Linux Enterprise Linux Enterprise Linux Desktop and 3 more
CVE-2018-1094

kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4 image

The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always initialize the crc32c checksum driver, which allows attackers to cause a denial of service (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.

CVSS 3.1 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 4 more
CVE-2018-1089

389-ds-base: ns-slapd crash via large filter value in ldapsearch

389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.

CVSS 3.0 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux 389 Directory Server Enterprise Linux and 3 more
CVE-2018-1087

Kernel: KVM: error in exception handling leads to wrong debug stack value

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.

CVSS 3.0 · 8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 13 more
CVE-2018-1083

zsh: Stack-based buffer overflow in gen_matches_files() at compctl.c

Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 4 more
CVE-2018-1071

zsh: Stack-based buffer overflow in exec.c:hashcmd()

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 4 more
CVE-2018-1068

kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c

A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 14 more
CVE-2018-1054

389-ds-base: remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 in collate.c

An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.

CVSS 3.0 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Enterprise Linux Enterprise Linux Desktop and 2 more
CVE-2018-1050

samba: NULL pointer dereference in printer server process

All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.

CVSS 3.1 · 4.3 Medium EPSS 6.5% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 5 more
CVE-2018-1049

systemd: automount: access to automounted volumes can lock up

In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted.

CVSS 3.1 · 5.9 Medium EPSS 7.4% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 8 more
CVE-2018-19535

exiv2: heap-based buffer over-read in PngChunk::readRawProfile in pngchunk_int.cpp

In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a heap-based buffer over-read) via a crafted PNG file.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 1 more
Products
Ubuntu Linux Debian Linux Exiv2 and 4 more