Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,902

Export CSV
CVE-2018-16884

kernel: nfs: use-after-free in svc_process_common()

A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.

CVSS 3.1 · 8.0 High EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 5 more
CVE-2018-16396

ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.

CVSS 3.0 · 8.1 High EPSS 8.0% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 6 more
CVE-2018-13405

kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-members

The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed
Vendors
Canonical Debian F5 and 3 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 31 more
CVE-2018-12207

hw: Machine Check Error on Page Size Change (IFU)

Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian F5 and 5 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 1538 more
CVE-2018-10853

kernel: kvm: guest userspace to guest kernel write

A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest.

CVSS 3.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 6 more
CVE-2018-10675

kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact

The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system calls.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 13 more
CVE-2018-10360

file: out-of-bounds read via a crafted ELF file

The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.

CVSS 3.0 · 6.5 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical File Project Opensuse and 1 more
Products
Ubuntu Linux File Leap and 6 more
CVE-2018-1000199

kernel: ptrace() incorrect error handling leads to corruption and DoS

The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption. This attack appear to be exploitable via local code execution and the ability to use ptrace. This vulnerability appears to have been fixed in git commit f67b15037a7a50c57f72e69a6d59941ad90a0f0f.

CVSS 3.0 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 13 more
CVE-2018-1000140

librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c

rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.

CVSS 3.0 · 9.8 Critical EPSS 9.3% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 11 more
CVE-2018-1000122

curl: RTSP RTP buffer over-read

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage

CVSS 3.0 · 9.1 Critical EPSS 9.0% KEV · Not listed
Vendors
Canonical Debian Haxx and 2 more
Products
Ubuntu Linux Debian Linux Curl and 13 more
CVE-2018-1000121

curl: LDAP NULL pointer dereference

A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service

CVSS 3.0 · 7.5 High EPSS 9.2% KEV · Not listed
Vendors
Canonical Debian Haxx and 2 more
Products
Ubuntu Linux Debian Linux Curl and 13 more
CVE-2018-1000120

curl: FTP path trickery leads to NIL byte out of bounds write

A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.

CVSS 3.0 · 9.8 Critical EPSS 11.6% KEV · Not listed
Vendors
Canonical Debian Haxx and 2 more
Products
Ubuntu Linux Debian Linux Curl and 13 more
CVE-2018-1000079

rubygems: Path traversal issue during gem installation allows to write to arbitrary filesystem locations

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.

CVSS 3.0 · 5.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Redhat Rubygems
Products
Enterprise Linux Rhel Aus Rhel E4s and 4 more
CVE-2018-1000078

rubygems: XSS vulnerability in homepage attribute when displayed via gem server

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.

CVSS 3.0 · 6.1 Medium EPSS 2.7% KEV · Not listed
Vendors
Debian Redhat Rubygems
Products
Debian Linux Enterprise Linux Rhel Aus and 5 more
CVE-2018-1000077

rubygems: Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.

CVSS 3.0 · 5.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Debian Redhat Rubygems
Products
Debian Linux Enterprise Linux Rhel Aus and 5 more
CVE-2018-1000076

rubygems: Improper verification of signatures in tarball allows to install mis-signed gem

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.

CVSS 3.0 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Debian Redhat Rubygems
Products
Debian Linux Enterprise Linux Rhel Aus and 5 more
CVE-2018-1000075

rubygems: Infinite loop vulnerability due to negative size in tar header causes Denial of Service

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.

CVSS 3.0 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Debian Redhat Rubygems
Products
Debian Linux Enterprise Linux Rhel Aus and 5 more
CVE-2018-1000074

rubygems: Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.

CVSS 3.0 · 7.8 High EPSS 2.9% KEV · Not listed
Vendors
Redhat Rubygems
Products
Enterprise Linux Rhel Aus Rhel E4s and 4 more
CVE-2018-1000073

rubygems: Path traversal when writing to a symlinked basedir outside of the root

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.

CVSS 3.0 · 7.5 High EPSS 4.9% KEV · Not listed
Vendors
Redhat Rubygems
Products
Enterprise Linux Rhel Aus Rhel E4s and 4 more
CVE-2018-1000007

curl: HTTP authentication leak in redirects

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.

CVSS 3.1 · 9.8 Critical EPSS 9.9% KEV · Not listed
Vendors
Canonical Debian Fujitsu and 2 more
Products
Ubuntu Linux Debian Linux M10-1 and 24 more