CVE-2022-1012

kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak

A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.

CVSS 3.1 · 8.2 High EPSS 4.4% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel E4s and 2 more

CVE-2022-0563

util-linux: partial disclosure of arbitrary files in chfn and chsh when compiled with libreadline

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kernel Netapp

Products

Util-linux Ontap Select Deploy Administration Utility

CVE-2021-43396

glibc: conversion from ISO-2022-JP-3 with iconv may emit spurious NUL character on state reset

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed

Vendors

Gnu Oracle

Products

Glibc Communications Cloud Native Core Binding Support Function Communications Cloud Native Core Network Function Cloud Native Environment and 4 more

CVE-2021-33560

libgcrypt: mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed

Vendors

Debian Fedoraproject Gnupg and 2 more

Products

Debian Linux Fedora Libgcrypt and 6 more

CVE-2026-76273

Improper Input Validation through the collect Command in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to add attacker-controlled content to system-level messages on the Splunk platform instance. The vulnerability is possible because the collect command does not validate the index name before processing the value. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and System endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/rest-api-reference/10.4/system-endpoints/system-endpoint-descriptions) in the Splunk documentation.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Splunk

Products

Splunk Splunk Enterprise

CVE-2026-76277

Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the username is used for a user directory. This can cause distinct native Splunk usernames to share per-user configuration data, and user-management operations can affect the wrong account or fail. For more information see Set up native Splunk authentication (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-the-native-splunk-platform-authentication-scheme/set-up-native-splunk-authentication) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Splunk

Products

Splunk Splunk Enterprise

CVE-2026-76279

Improper Input Validation of Index Names through the collect Command in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to write events to internal indexes outside the index access configured for the role. The vulnerability is possible because Splunk Enterprise does not normalize whitespace in an index name before applying configured index-access restrictions for the role. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and How indexing works (https://help.splunk.com/en/splunk-enterprise/administer/manage-indexers-and-indexer-clusters/10.4/indexing-overview/how-indexing-works) in the Splunk documentation.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Splunk

Products

Splunk Splunk Enterprise

CVE-2021-22925

curl: Incorrect fix for CVE-2021-22898 TELNET stack contents disclosure

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.

CVSS 3.1 · 5.3 Medium EPSS 5.4% KEV · Not listed

Vendors

Apple Fedoraproject Haxx and 5 more

Products

Mac Os X Macos Fedora and 25 more

CVE-2021-22924

curl: Bad connection reuse due to flawed path name checks

libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.

CVSS 3.1 · 3.7 Low EPSS 6.3% KEV · Not listed

Vendors

Debian Fedoraproject Haxx and 5 more

Products

Debian Linux Fedora Libcurl and 52 more

CVE-2021-22922

curl: Content not matching hash in Metalink is not being discarded

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.

CVSS 3.1 · 6.5 Medium EPSS 4.3% KEV · Not listed

Vendors

Fedoraproject Haxx Netapp and 4 more

Products

Fedora Curl Cloud Backup and 22 more

CVE-2021-22898

curl: TELNET stack contents disclosure

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

CVSS 3.1 · 3.1 Low EPSS 4.5% KEV · Not listed

Vendors

Debian Fedoraproject Haxx and 4 more

Products

Debian Linux Fedora Curl and 10 more

CVE-2021-22876

curl: Leak of authentication credentials in URL via automatic Referer

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

CVSS 3.1 · 5.3 Medium EPSS 5.3% KEV · Not listed

Vendors

Broadcom Debian Fedoraproject and 6 more

Products

Fabric Operating System Debian Linux Fedora and 12 more

CVE-2021-3580

nettle: Remote crash in RSA decryption via manipulated ciphertext

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Debian Netapp Nettle Project and 1 more

Products

Debian Linux Ontap Select Deploy Administration Utility Nettle and 1 more

CVE-2021-3426

python: Information disclosure via pydoc

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.

CVSS 3.1 · 5.7 Medium EPSS 1.9% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 3 more

Products

Debian Linux Fedora Cloud Backup and 8 more

CVE-2021-3326

glibc: Assertion failure in ISO-2022-JP-3 gconv module related to combining characters

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Debian Fujitsu Gnu and 3 more

Products

Debian Linux M10-1 M10-1 Firmware and 15 more

CVE-2020-29562

glibc: assertion failure in iconv when converting invalid UCS4

The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

CVSS 3.1 · 4.8 Medium EPSS 1.7% KEV · Not listed

Vendors

Fedoraproject Gnu Netapp

Products

Fedora Glibc E-series Santricity Os Controller

CVE-2020-24977

libxml2: Buffer overflow vulnerability in xmlEncodeEntitiesInternal() in entities.c

GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.

CVSS 3.1 · 6.5 Medium EPSS 3.0% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 4 more

Products

Debian Linux Fedora Active Iq Unified Manager and 17 more

CVE-2020-24659

gnutls: Heap buffer overflow in handshake with no_renegotiation alert sent

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Canonical Fedoraproject Gnu and 2 more

Products

Ubuntu Linux Fedora Gnutls and 2 more

CVE-2020-14145

openssh: Observable discrepancy leading to an information leak in the algorithm negotiation

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

CVSS 3.1 · 5.9 Medium EPSS 2.9% KEV · Not listed

Vendors

Netapp Openbsd Redhat

Products

Active Iq Unified Manager Aff A700s Aff A700s Firmware and 8 more

CVE-2020-13631

sqlite: Virtual table can be renamed into the name of one of its shadow tables

SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Broadcom Canonical and 6 more

Products

Icloud Ipados Iphone Os and 17 more