Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2018-17189

httpd: mod_http2: DoS via slow, unneeded request bodies

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

CVSS 3.1 · 5.3 Medium EPSS 19.4% KEV · Not listed
Vendors
Apache Canonical Debian and 4 more
Products
Http Server Ubuntu Linux Debian Linux and 11 more
CVE-2018-17082

php: Cross-site scripting (XSS) flaw in Apache2 component via body of 'Transfer-Encoding: chunked' request

The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.

CVSS 3.0 · 6.1 Medium EPSS 4.1% KEV · Not listed
Vendors
Debian Netapp Php and 1 more
Products
Debian Linux Storage Automation Store Php and 1 more
CVE-2018-16850

postgresql: SQL injection in pg_upgrade and pg_dump, via CREATE TRIGGER ... REFERENCING

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

CVSS 3.1 · 9.8 Critical EPSS 5.1% KEV · Not listed
Vendors
Canonical Postgresql Redhat
Products
Ubuntu Linux Postgresql Enterprise Linux and 1 more
CVE-2018-16845

nginx: Denial of service and memory disclosure via mp4 module

nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.

CVSS 3.1 · 6.1 Medium EPSS 9.8% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Xcode Ubuntu Linux Debian Linux and 3 more
CVE-2018-16844

nginx: Excessive CPU usage via flaw in HTTP/2 implementation

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.

CVSS 3.1 · 7.5 High EPSS 12.7% KEV · Not listed
Vendors
Apple Canonical Debian and 2 more
Products
Xcode Ubuntu Linux Debian Linux and 2 more
CVE-2018-16843

nginx: Excessive memory consumption via flaw in HTTP/2 implementation

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.

CVSS 3.1 · 7.5 High EPSS 48.0% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Xcode Ubuntu Linux Debian Linux and 3 more
CVE-2018-16396

ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.

CVSS 3.0 · 8.1 High EPSS 8.0% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 6 more
CVE-2018-16395

ruby: OpenSSL::X509:: Name equality check does not work correctly

An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.

CVSS 3.0 · 9.8 Critical EPSS 10.7% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 4 more
CVE-2018-14884

php: Mishandled http_header_value in an atoi() call in http_fopen_wrapper.c

An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. Inappropriately parsing an HTTP response leads to a segmentation fault because http_header_value in ext/standard/http_fopen_wrapper.c can be a NULL value that is mishandled in an atoi call.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Netapp Php Redhat
Products
Storage Automation Store Php Rhel Software Collections
CVE-2018-14851

php: exif: Buffer over-read in exif_process_IFD_in_MAKERNOTE()

exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.

CVSS 3.0 · 5.5 Medium EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Netapp and 2 more
Products
Ubuntu Linux Debian Linux Storage Automation Store and 2 more
CVE-2018-14645

haproxy: Out-of-bounds read in HPACK decoder

A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.

CVSS 3.0 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Canonical Haproxy Redhat
Products
Ubuntu Linux Haproxy Enterprise Linux and 3 more
CVE-2018-12326

redis: Code execution in redis-cli via crafted command line arguments

Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source.

CVSS 3.0 · 8.4 High EPSS 2.6% KEV · Not listed
Vendors
Redhat Redislabs
Products
Openstack Rhel Software Collections Redis
CVE-2018-11763

httpd: DoS for HTTP/2 connections by continuous SETTINGS frames

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.

CVSS 3.0 · 5.9 Medium EPSS 51.0% KEV · Not listed
Vendors
Apache Canonical Netapp and 2 more
Products
Http Server Ubuntu Linux Storage Automation Store and 8 more
CVE-2018-11469

haproxy: Information disclosure in check_request_for_cacheability function in proto_http.c

Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.

CVSS 3.0 · 5.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Canonical Haproxy Redhat
Products
Ubuntu Linux Haproxy Rhel Software Collections
CVE-2018-11235

git: arbitrary code execution when recursively cloning a malicious repository

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

CVSS 3.0 · 7.8 High EPSS 47.4% KEV · Not listed
Vendors
Canonical Debian Git-scm and 2 more
Products
Ubuntu Linux Debian Linux Git and 7 more
CVE-2018-11233

git: path sanity check in is_ntfs_dotgit() can read arbitrary memory

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.

CVSS 3.0 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Canonical Git-scm Redhat
Products
Ubuntu Linux Git Rhel Software Collections
CVE-2018-10925

postgresql: Missing authorization and memory disclosure in INSERT ... ON CONFLICT DO UPDATE statements

It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.

CVSS 3.1 · 8.1 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 2 more
CVE-2018-10915

postgresql: Certain host connection parameters defeat client-side security defenses

A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an affected version of libpq was used with "host" or "hostaddr" connection parameters from untrusted input, attackers could bypass client-side connection security features, obtain access to higher privileged connections or potentially cause other impact through SQL injection, by causing the PQescape() functions to malfunction. Postgresql versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 are affected.

CVSS 3.0 · 8.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 9 more