Export limit exceeded: 425850 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,086

Export CSV
CVE-2018-11713

webkitgtk: WebSockets don't use system proxy settings

WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Gnome Redhat Webkitgtk
Products
Libsoup Enterprise Linux Webkitgtk\+
CVE-2018-11712

webkitgtk: Improper TLS certificate verification for WebSocket connections

WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions 2.20.0 and 2.20.1, failed to perform TLS certificate verification for WebSocket connections.

CVSS 3.0 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Redhat Webkitgtk
Products
Enterprise Linux Webkitgtk\+
CVE-2018-11685

liblouis: Stack-based buffer overflow in function compileHyphenation in compileTranslationTable.c

Liblouis 3.5.0 has a stack-based Buffer Overflow in the function compileHyphenation in compileTranslationTable.c.

CVSS 3.0 · 8.8 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Liblouis Opensuse and 1 more
Products
Ubuntu Linux Liblouis Leap and 1 more
CVE-2018-11684

liblouis: Stack-based buffer overflow in function includeFile in compileTranslationTable.c

Liblouis 3.5.0 has a stack-based Buffer Overflow in the function includeFile in compileTranslationTable.c.

CVSS 3.0 · 8.8 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Liblouis Opensuse and 1 more
Products
Ubuntu Linux Liblouis Leap and 1 more
CVE-2018-11656

ImageMagick: memory leak in ReadDCMImage function in coders/dcm.c

In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.

CVSS 3.0 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Imagemagick Redhat
Products
Ubuntu Linux Imagemagick Enterprise Linux
CVE-2018-11645

ghostscript: status command permitted with -dSAFER in psi/zfile.c allowing attackers to identify the size and existence of files

psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.

CVSS 3.0 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Artifex Redhat
Products
Ghostscript Enterprise Linux
CVE-2018-11506

kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other unspecified impact

The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a CDROMREADMODE2 ioctl call.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 1 more
CVE-2018-11439

taglib: heap-based buffer over-read via a crafted audio file

The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure (heap-based buffer over-read) via a crafted audio file.

CVSS 3.1 · 6.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Debian Redhat Taglib
Products
Debian Linux Enterprise Linux Taglib
CVE-2018-11412

kernel: out-of-bounds memcpy in fs/ext4/inline.c:ext4_read_inline_data() with crafted ext4 image

In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode.

CVSS 3.0 · 5.9 Medium EPSS 15.6% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux
CVE-2018-11362

wireshark: Out-of-bounds read in packet-ldss.c

In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by avoiding a buffer over-read upon encountering a missing '\0' character.

CVSS 3.0 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Debian Redhat Wireshark
Products
Debian Linux Enterprise Linux Wireshark
CVE-2018-11237

glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper

An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Gnu Netapp and 2 more
Products
Ubuntu Linux Glibc Data Ontap Edge and 8 more
CVE-2018-11236

glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer overflow

stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.

CVSS 3.0 · 9.8 Critical EPSS 6.9% KEV · Not listed
Vendors
Gnu Netapp Oracle and 1 more
Products
Glibc Data Ontap Edge Element Software Management and 7 more
CVE-2018-11235

git: arbitrary code execution when recursively cloning a malicious repository

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

CVSS 3.0 · 7.8 High EPSS 47.4% KEV · Not listed
Vendors
Canonical Debian Git-scm and 2 more
Products
Ubuntu Linux Debian Linux Git and 7 more
CVE-2018-11214

libjpeg: Segmentation fault in get_text_rgb_row function in rdppm.c

An issue was discovered in libjpeg 9a. The get_text_rgb_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Ijg and 1 more
Products
Ubuntu Linux Debian Linux Libjpeg and 1 more
CVE-2018-11213

libjpeg: Segmentation fault in get_text_gray_row function in rdppm.c

An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Ijg and 1 more
Products
Ubuntu Linux Debian Linux Libjpeg and 1 more
CVE-2018-11053

iSM: Dell EMC iDRAC Service Module Improper File Permission Vulnerability

Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission of the hosts file of the host operating system (/etc/hosts) to world writable. A malicious low privileged operating system user or process could modify the host file and potentially redirect traffic from the intended destination to sites hosting malicious or unwanted content.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Citrix Dell Redhat and 1 more
Products
Xenserver Emc Idrac Service Module Enterprise Linux and 1 more
CVE-2018-11037

exiv2: information leak via a crafted file

In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Exiv2 Redhat
Products
Exiv2 Enterprise Linux
CVE-2018-10999

exiv2: heap-based buffer over-read in parseTXTChunk function

An issue was discovered in Exiv2 0.26. The Exiv2::Internal::PngChunk::parseTXTChunk function has a heap-based buffer over-read.

CVSS 3.0 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 1 more
Products
Ubuntu Linux Debian Linux Exiv2 and 1 more
CVE-2018-10998

exiv2: SIGABRT by triggering an incorrect Safe::add call

An issue was discovered in Exiv2 0.26. readMetadata in jp2image.cpp allows remote attackers to cause a denial of service (SIGABRT) by triggering an incorrect Safe::add call.

CVSS 3.1 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Exiv2 and 1 more
Products
Ubuntu Linux Debian Linux Exiv2 and 4 more