Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2015-0243

postgresql: buffer overflow flaws in contrib/pgcrypto

Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

CVSS 3.1 · 8.8 High EPSS 5.1% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 2 more
CVE-2015-0241

postgresql: buffer overflow in the to_char() function

The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric formatting template, which triggers a buffer over-read, or (2) crafted timestamp formatting template, which triggers a buffer overflow.

CVSS 3.1 · 8.8 High EPSS 5.5% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 2 more
CVE-2014-8161

postgresql: information leak through constraint violation errors

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.

CVSS 3.1 · 4.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Postgresql Redhat
Products
Debian Linux Postgresql Enterprise Linux and 2 more
CVE-2014-4650

python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

CVSS 3.1 · 9.8 Critical EPSS 23.9% KEV · Not listed
Vendors
Python Redhat
Products
Python Enterprise Linux Rhel Software Collections and 1 more
CVE-2013-1753

python: XMLRPC library unrestricted decompression of HTTP responses using gzip enconding

The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Python Redhat
Products
Python Enterprise Linux Rhel Software Collections
CVE-2011-2767

mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess

mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.

CVSS 3.0 · 9.8 Critical EPSS 8.8% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Mod Perl Ubuntu Linux Debian Linux and 5 more
CVE-2022-27458

mariadb: use-after-poison in Binary_string::free_buffer

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-27447. Reason: This candidate is a reservation duplicate of CVE-2022-27447. Notes: All CVE users should reference CVE-2022-27447 instead of this candidate.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Software Collections
CVE-2021-20095

python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Software Collections
CVE-2016-5617

mysql: insecure error log file handling in mysqld_safe (CPU Oct 2016)

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-6664. Reason: This candidate is a reservation duplicate of CVE-2016-6664. Notes: All CVE users should reference CVE-2016-6664 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

CVSS 3.0 · 7.8 High EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Software Collections
CVE-2016-5616

mysql: race condition while setting stats during MyISAM table repair (CPU Oct 2016)

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-6663. Reason: This candidate is a reservation duplicate of CVE-2016-6663. Notes: All CVE users should reference CVE-2016-6663 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

CVSS 3.0 · 7.0 High EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Software Collections
CVE-2016-5483

mysql: Incorrect input validation allowing code execution via mysqldump

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-3600. Reason: This candidate is a reservation duplicate of CVE-2017-3600. Notes: All CVE users should reference CVE-2017-3600 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

CVSS 3.0 · 6.4 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Software Collections
CVE-2016-1000023

nodejs-minimatch: Regular expression denial-of-service

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10540. Reason: This candidate is a reservation duplicate of CVE-2016-10540. Notes: All CVE users should reference CVE-2016-10540 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

CVSS 3.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Openshift Rhel Software Collections
CVE-2013-1752

python: multiple unbound readline() DoS flaws in python stdlib

Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of service (memory consumption) via a long string, related to (1) httplib - fixed in 2.7.4, 2.6.9, and 3.3.3; (2) ftplib - fixed in 2.7.6, 2.6.9, 3.3.3; (3) imaplib - not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; (4) nntplib - fixed in 2.7.6, 2.6.9, 3.3.3; (5) poplib - not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; and (6) smtplib - not yet fixed in 2.7.x, fixed in 2.6.9, not yet fixed in 3.3.x. NOTE: this was REJECTed because it is incompatible with CNT1 "Independently Fixable" in the CVE Counting Decisions

CVSS 2.0 · 4.3 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Software Collections