Export limit exceeded: 425865 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,842

Export CSV
CVE-2021-20270

python-pygments: Infinite loop in SML lexer may lead to DoS

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Debian Fedoraproject Pygments and 1 more
Products
Debian Linux Fedora Pygments and 6 more
CVE-2021-20269

kexec-tools: incorrect permissions on kdump dmesg file

A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal information from a previous panic. The highest threat from this vulnerability is to confidentiality. This flaw affects kexec-tools shipped by Fedora versions prior to 2.0.21-8 and RHEL versions prior to 2.0.20-47.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Kexec-tools Project Redhat
Products
Fedora Kexec-tools Enterprise Linux
CVE-2021-20266

rpm: missing length checks in hdrblobInit()

A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 4.9 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Redhat Rpm
Products
Fedora Enterprise Linux Rpm
CVE-2021-20257

QEMU: net: e1000: infinite loop while processing transmit descriptors

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Qemu and 1 more
Products
Debian Linux Fedora Qemu and 6 more
CVE-2021-20254

samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process token

A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS 3.1 · 6.8 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 6 more
CVE-2021-20246

ImageMagick: Division by zero in ScaleResampleFilter in MagickCore/resample.c

A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Imagemagick and 1 more
Products
Debian Linux Fedora Imagemagick and 1 more
CVE-2021-20245

ImageMagick: Division by zero in WriteAnimatedWEBPImage() in coders/webp.c

A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Imagemagick and 1 more
Products
Debian Linux Fedora Imagemagick and 1 more
CVE-2021-20244

ImageMagick: Division by zero in ImplodeImage in MagickCore/visual-effects.c

A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of math division by zero. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Imagemagick and 1 more
Products
Debian Linux Fedora Imagemagick and 1 more
CVE-2021-20239

kernel: setsockopt System Call Untrusted Pointer Dereference Information Disclosure

A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an attacker with a local account to leak information about kernel internal addresses. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux
CVE-2021-20236

zeromq: Stack overflow on server running PUB/XPUB socket

A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Redhat Zeromq
Products
Fedora Ceph Storage Enterprise Linux and 1 more
CVE-2021-20233

grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Gnu Netapp and 1 more
Products
Fedora Grub2 Ontap Select Deploy Administration Utility and 9 more
CVE-2021-20229

postgresql: single-column SELECT privilege enables reading all columns

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all columns of the table. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 4.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Postgresql Redhat
Products
Fedora Postgresql Enterprise Linux and 1 more
CVE-2021-20225

grub2: Heap out-of-bounds write in short form option parser

A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 6.7 Medium EPSS 1.0% KEV · Not listed
Vendors
Fedoraproject Gnu Netapp and 1 more
Products
Fedora Grub2 Ontap Select Deploy Administration Utility and 9 more
CVE-2021-20208

cifs-utils: Container can use kerberos cache from the host via mount.cifs/cifs.upcall

A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Samba
Products
Fedora Enterprise Linux Cifs-utils
CVE-2021-20179

pki-core: Unprivileged users can renew any certificate

A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed
Vendors
Dogtagpki Fedoraproject Redhat
Products
Dogtagpki Fedora Certificate System and 2 more
CVE-2021-20178

ansible: user data leak in snmp_facts module

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Ansible Ansible Automation Platform and 4 more
CVE-2021-1998

mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2021)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 3.8 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L).

CVSS 3.1 · 3.8 Low EPSS 1.6% KEV · Not listed
Vendors
Fedoraproject Netapp Oracle and 1 more
Products
Fedora Active Iq Unified Manager Oncommand Insight and 7 more
CVE-2021-1844

webkitgtk: Memory corruption issue leading to arbitrary code execution

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 2.4% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 1 more
Products
Ipados Iphone Os Macos and 7 more
CVE-2021-1801

webkitgtk: IFrame sandboxing policy violation

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Apple Fedoraproject Redhat and 1 more
Products
Ipad Os Iphone Os Macos and 6 more
CVE-2021-1799

webkitgtk: Access to restricted ports on arbitrary servers via port redirection

A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. A malicious website may be able to access restricted ports on arbitrary servers.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Apple Fedoraproject Redhat and 1 more
Products
Ipad Os Iphone Os Macos and 7 more