Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2017-18869

nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Chownr Project Redhat
Products
Chownr Rhel Software Collections
CVE-2017-17742

ruby: HTTP response splitting in WEBrick

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick.

CVSS 3.0 · 5.3 Medium EPSS 5.5% KEV · Not listed
Vendors
Debian Redhat Ruby-lang
Products
Debian Linux Enterprise Linux Rhel Aus and 5 more
CVE-2017-15715

httpd: <FilesMatch> bypass with a trailing newline in the file name

In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.

CVSS 3.0 · 8.1 High EPSS 86.2% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Http Server Ubuntu Linux Debian Linux and 7 more
CVE-2017-15710

httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values

In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all.

CVSS 3.0 · 7.5 High EPSS 17.5% KEV · Not listed
Vendors
Apache Canonical Debian and 2 more
Products
Http Server Ubuntu Linux Debian Linux and 7 more
CVE-2017-15365

mariadb: Replication in sql/event_data_objects.cc occurs before ACL checks

sql/event_data_objects.cc in MariaDB before 10.1.30 and 10.2.x before 10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x before 5.7.19-29.22-3 allows remote authenticated users with SQL access to bypass intended access restrictions and replicate data definition language (DDL) statements to cluster nodes by leveraging incorrect ordering of DDL replication and ACL checking.

CVSS 3.0 · 8.8 High EPSS 3.3% KEV · Not listed
Vendors
Fedoraproject Mariadb Percona and 1 more
Products
Fedora Mariadb Xtradb Cluster and 1 more
CVE-2017-15097

postgresql: Start scripts permit database administrator to modify root-owned files

Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker with access to the postgres user account could use these flaws to obtain root access on the server machine.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Server and 5 more
CVE-2016-8625

curl: IDNA 2003 makes curl use wrong host

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.

CVSS 3.0 · 5.3 Medium EPSS 4.3% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2016-8618

curl: Double-free in curl_maprintf

The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables.

CVSS 3.0 · 5.3 Medium EPSS 4.6% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2016-8616

curl: Case insensitive password comparison

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.

CVSS 3.0 · 3.7 Low EPSS 3.5% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services Rhel Software Collections
CVE-2016-6814

Groovy: Remote code execution via deserialization

When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.

CVSS 3.0 · 9.8 Critical EPSS 17.2% KEV · Not listed
Vendors
Apache Redhat
Products
Groovy Enterprise Linux Enterprise Linux Server and 4 more
CVE-2016-1000232

nodejs-tough-cookie: regular expression DoS via Cookie header with many semicolons

NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.

CVSS 3.0 · 5.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Ibm Redhat Salesforce
Products
Api Connect Openshift Openshift Container Platform and 2 more
CVE-2016-1000110

CGIHandler: sets environmental variable based on user supplied Proxy request header

The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.

CVSS 3.1 · 6.1 Medium EPSS 4.5% KEV · Not listed
Vendors
Debian Fedoraproject Python and 1 more
Products
Debian Linux Fedora Python and 2 more
CVE-2015-3167

postgresql: pgcrypto has multiple error messages for decryption with an incorrect key.

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 2 more
CVE-2015-3166

postgresql: unanticipated errors from the standard library

The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.

CVSS 3.1 · 9.8 Critical EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Postgresql and 1 more
Products
Ubuntu Linux Debian Linux Postgresql and 2 more
CVE-2015-2326

pcre: heap buffer over-read in pcre_compile2() (8.37/23)

The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".

CVSS 3.1 · 5.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Mariadb Opensuse Pcre and 2 more
Products
Mariadb Opensuse Pcre and 2 more
CVE-2015-2325

pcre: heap buffer overflow in compile_branch()

The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.

CVSS 3.1 · 7.8 High EPSS 1.6% KEV · Not listed
Vendors
Mariadb Opensuse Pcre and 2 more
Products
Mariadb Opensuse Pcre and 2 more
CVE-2015-0244

postgresql: loss of frontend/backend protocol synchronization after an error

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation.

CVSS 3.1 · 9.8 Critical EPSS 4.4% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 2 more