Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 383

Export CSV
CVE-2024-13176

Timing side-channel in ECDSA signature computation

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Netapp Openssl
Products
Debian Linux 500f 500f Firmware and 44 more
CVE-2023-5178

Kernel: use after free in nvmet_tcp_free_crypto in nvme

A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.

CVSS 3.1 · 8.8 High EPSS 9.6% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Active Iq Unified Manager Solidfire \& Hci Management Node and 8 more
CVE-2022-2068

The c_rehash script allows command injection

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

CVSS 3.1 · 9.8 Critical EPSS 96.4% KEV · Not listed
Vendors
Broadcom Debian Fedoraproject and 4 more
Products
Sannav Debian Linux Fedora and 46 more
CVE-2022-1292

The c_rehash script allows command injection

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

CVSS 3.1 · 9.8 Critical EPSS 82.6% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 4 more
Products
Debian Linux Fedora A250 and 55 more
CVE-2022-27779

curl: cookie for trailing dot TLD

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Haxx Netapp Splunk
Products
Curl Clustered Data Ontap H300s and 12 more
CVE-2025-0725

gzip integer overflow

When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

CVSS 3.1 · 7.3 High EPSS 1.8% KEV · Not listed
Vendors
Haxx Netapp Zlib
Products
Curl Libcurl Hci Baseboard Management Controller and 9 more
CVE-2025-0167

netrc and default credential leak

When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Curl Haxx Netapp
Products
Curl Curl Bootstrap Os and 23 more
CVE-2022-43680

expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Debian Fedoraproject Libexpat Project and 2 more
Products
Debian Linux Fedora Libexpat and 21 more
CVE-2022-36946

kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.

CVSS 3.1 · 7.5 High EPSS 8.9% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel Active Iq Unified Manager and 7 more
CVE-2022-35252

curl: Incorrect handling of control code characters in cookies

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

CVSS 3.1 · 3.7 Low EPSS 3.8% KEV · Not listed
Vendors
Apple Debian Haxx and 3 more
Products
Macos Debian Linux Curl and 18 more
CVE-2022-32208

curl: FTP-KRB bad message verification

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

CVSS 3.1 · 5.9 Medium EPSS 8.4% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 4 more
Products
Macos Debian Linux Fedora and 18 more
CVE-2022-32207

curl: Unpreserved file permissions

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.

CVSS 3.1 · 9.8 Critical EPSS 12.3% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 4 more
Products
Macos Debian Linux Fedora and 18 more
CVE-2022-32206

curl: HTTP compression denial of service

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

CVSS 3.1 · 6.5 Medium EPSS 36.3% KEV · Not listed
Vendors
Debian Fedoraproject Haxx and 4 more
Products
Debian Linux Fedora Curl and 32 more
CVE-2022-32205

curl: Set-Cookie denial of service

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.

CVSS 3.1 · 4.3 Medium EPSS 31.5% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 4 more
Products
Macos Debian Linux Fedora and 26 more
CVE-2022-30115

curl: HSTS bypass via trailing dot

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.

CVSS 3.1 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Haxx Netapp Splunk
Products
Curl Clustered Data Ontap H300s and 12 more
CVE-2022-29824

libxml2: integer overflows in xmlBuf and xmlBuffer lead to out-of-bounds write

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

CVSS 3.1 · 6.5 Medium EPSS 3.8% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Active Iq Unified Manager and 23 more
CVE-2022-27781

curl: CERTINFO never-ending busy-loop

libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Debian Haxx Netapp and 2 more
Products
Debian Linux Curl Clustered Data Ontap and 14 more
CVE-2022-27780

curl: percent-encoded path separator in URL host

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.

CVSS 3.1 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Haxx Netapp Splunk
Products
Curl Clustered Data Ontap H300s and 15 more