Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 104

Export CSV
CVE-2024-13176

Timing side-channel in ECDSA signature computation

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Netapp Openssl
Products
Debian Linux 500f 500f Firmware and 44 more
CVE-2023-5178

Kernel: use after free in nvmet_tcp_free_crypto in nvme

A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.

CVSS 3.1 · 8.8 High EPSS 9.6% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Active Iq Unified Manager Solidfire \& Hci Management Node and 8 more
CVE-2022-1292

The c_rehash script allows command injection

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

CVSS 3.1 · 9.8 Critical EPSS 82.6% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 4 more
Products
Debian Linux Fedora A250 and 55 more
CVE-2022-27779

curl: cookie for trailing dot TLD

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Haxx Netapp Splunk
Products
Curl Clustered Data Ontap H300s and 12 more
CVE-2025-0725

gzip integer overflow

When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

CVSS 3.1 · 7.3 High EPSS 1.8% KEV · Not listed
Vendors
Haxx Netapp Zlib
Products
Curl Libcurl Hci Baseboard Management Controller and 9 more
CVE-2025-0167

netrc and default credential leak

When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Curl Haxx Netapp
Products
Curl Curl Bootstrap Os and 23 more
CVE-2022-43680

expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Debian Fedoraproject Libexpat Project and 2 more
Products
Debian Linux Fedora Libexpat and 21 more
CVE-2022-36946

kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.

CVSS 3.1 · 7.5 High EPSS 8.9% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel Active Iq Unified Manager and 7 more
CVE-2022-30115

curl: HSTS bypass via trailing dot

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or the otherway around - by having the trailing dot in the HSTS cache and *not* using thetrailing dot in the URL.

CVSS 3.1 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Haxx Netapp Splunk
Products
Curl Clustered Data Ontap H300s and 12 more
CVE-2022-29824

libxml2: integer overflows in xmlBuf and xmlBuffer lead to out-of-bounds write

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.

CVSS 3.1 · 6.5 Medium EPSS 3.8% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Active Iq Unified Manager and 23 more
CVE-2022-27781

curl: CERTINFO never-ending busy-loop

libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Debian Haxx Netapp and 2 more
Products
Debian Linux Curl Clustered Data Ontap and 14 more
CVE-2022-27780

curl: percent-encoded path separator in URL host

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, would be allowed bythe parser and get transposed into `http://example.com/127.0.0.1/`. This flawcan be used to circumvent filters, checks and more.

CVSS 3.1 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Haxx Netapp Splunk
Products
Curl Clustered Data Ontap H300s and 15 more
CVE-2022-27775

curl: bad local IPv6 connection reuse

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Broadcom Debian Haxx and 3 more
Products
Fabric Operating System Debian Linux Curl and 15 more
CVE-2022-27774

curl: credential leak on redirect

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

CVSS 3.1 · 5.7 Medium EPSS 2.0% KEV · Not listed
Vendors
Broadcom Debian Haxx and 3 more
Products
Fabric Operating System Debian Linux Curl and 15 more
CVE-2022-22576

curl: OAUTH2 bearer bypass in connection re-use

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

CVSS 3.1 · 8.1 High EPSS 2.5% KEV · Not listed
Vendors
Broadcom Debian Haxx and 3 more
Products
Fabric Operating System Debian Linux Curl and 15 more
CVE-2022-1473

Resource leakage when decoding certificates and keys

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Netapp Openssl Redhat
Products
A250 A250 Firmware A700s and 41 more