Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2021-43618

gmp: Integer overflow and resultant buffer overflow via crafted input

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.

CVSS 3.1 · 7.5 High EPSS 4.5% KEV · Not listed
Vendors
Debian Gmplib Netapp and 1 more
Products
Debian Linux Gmp Active Iq Unified Manager and 13 more
CVE-2021-41617

openssh: privilege escalation when AuthorizedKeysCommand or AuthorizedPrincipalsCommand are configured

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

CVSS 3.1 · 7.0 High EPSS 2.5% KEV · Not listed
Vendors
Fedoraproject Netapp Openbsd and 3 more
Products
Fedora Active Iq Unified Manager Aff 500f and 12 more
CVE-2021-37750

krb5: NULL pointer dereference in process_tgs_req() in kdc/do_tgs_req.c via a FAST inner body that lacks server field

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Fedoraproject Mit and 3 more
Products
Debian Linux Fedora Kerberos 5 and 3 more
CVE-2021-36222

krb5: Sending a request containing PA-ENCRYPTED-CHALLENGE padata element without using FAST could result in NULL dereference in KDC which leads to DoS

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.

CVSS 3.1 · 7.5 High EPSS 10.5% KEV · Not listed
Vendors
Debian Mit Netapp and 2 more
Products
Debian Linux Kerberos 5 Active Iq Unified Manager and 5 more
CVE-2021-36087

libsepol: heap-based buffer overflow in ebitmap_match_any()

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Selinux Project
Products
Fedora Enterprise Linux Selinux
CVE-2021-35942

glibc: Arbitrary read in wordexp()

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed
Vendors
Debian Gnu Netapp and 1 more
Products
Debian Linux Glibc Active Iq Unified Manager and 5 more
CVE-2021-33910

systemd: uncontrolled allocation on the stack in function unit_name_path_escape leads to crash

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.

CVSS 3.1 · 5.5 Medium EPSS 8.8% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 2 more
Products
Debian Linux Fedora Hci Management Node and 5 more
CVE-2021-33574

glibc: mq_notify does not handle separately allocated thread attributes

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Debian Fedoraproject Gnu and 2 more
Products
Debian Linux Fedora Glibc and 18 more
CVE-2021-33560

libgcrypt: mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Debian Fedoraproject Gnupg and 2 more
Products
Debian Linux Fedora Libgcrypt and 6 more
CVE-2021-28861

python: open redirection vulnerability in lib/http/server.py may lead to information disclosure

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Python Redhat
Products
Fedora Python Enterprise Linux and 1 more
CVE-2021-28153

glib: g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION creates empty target for dangling symlink

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

CVSS 3.1 · 5.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 2 more
Products
Brocade Fabric Operating System Firmware Debian Linux Fedora and 2 more
CVE-2021-27645

glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c

The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Gnu and 1 more
Products
Debian Linux Fedora Glibc and 1 more
CVE-2021-27219

glib: integer overflow in g_bytes_new function on 64-bit platforms due to an implicit cast from 64 bits to 32 bits

An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.

CVSS 3.1 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 3 more
Products
Brocade Fabric Operating System Firmware Debian Linux Fedora and 12 more
CVE-2021-27218

glib: integer overflow in g_byte_array_new_take function when called with a buffer of 4GB or more on a 64-bit platform

An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 3 more
Products
Brocade Fabric Operating System Firmware Debian Linux Fedora and 5 more
CVE-2021-23336

Web Cache Poisoning

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

CVSS 3.1 · 5.9 Medium EPSS 41.1% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 4 more
Products
Debian Linux Django Fedora and 11 more
CVE-2021-22947

curl: Server responses received before STARTTLS processed after TLS handshake

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

CVSS 3.1 · 5.9 Medium EPSS 3.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 6 more
Products
Macos Debian Linux Fedora and 34 more