Export limit exceeded: 24818 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2019-19925

sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

CVSS 3.1 · 7.5 High EPSS 6.8% KEV · Not listed
Vendors
Debian Netapp Opensuse and 5 more
Products
Debian Linux Cloud Backup Backports Sle and 11 more
CVE-2019-19924

sqlite: incorrect sqlite3WindowRewrite() error handling leads to mishandling certain parser-tree rewriting

SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.

CVSS 3.1 · 5.3 Medium EPSS 10.7% KEV · Not listed
Vendors
Apache Netapp Oracle and 3 more
Products
Bookkeeper Cloud Backup Mysql Workbench and 3 more
CVE-2019-19923

sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer dereference

flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).

CVSS 3.1 · 7.5 High EPSS 6.8% KEV · Not listed
Vendors
Debian Netapp Opensuse and 5 more
Products
Debian Linux Cloud Backup Backports Sle and 11 more
CVE-2019-19906

cyrus-sasl: denial of service in _sasl_add_string function

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

CVSS 3.1 · 7.5 High EPSS 8.0% KEV · Not listed
Vendors
Apache Apple Canonical and 5 more
Products
Bookkeeper Ipados Iphone Os and 17 more
CVE-2019-19880

sqlite: invalid pointer dereference in exprListAppendList in window.c

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

CVSS 3.1 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Debian Netapp Opensuse and 5 more
Products
Debian Linux Cloud Backup Backports Sle and 10 more
CVE-2019-9948

python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVSS 3.1 · 9.1 Critical EPSS 11.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2019-9947

python: CRLF injection via the path part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVSS 3.1 · 5.4 Medium EPSS 5.3% KEV · Not listed
Vendors
Python Redhat
Products
Python Ansible Tower Enterprise Linux and 5 more
CVE-2019-9740

python: CRLF injection via the query part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVSS 3.1 · 6.5 Medium EPSS 5.4% KEV · Not listed
Vendors
Python Redhat
Products
Python Ansible Tower Enterprise Linux and 5 more
CVE-2019-9636

python: Information Disclosure due to urlsplit improper NFKC normalization

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVSS 3.1 · 5.3 Medium EPSS 7.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2019-9169

glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

CVSS 3.1 · 9.8 Critical EPSS 4.7% KEV · Not listed
Vendors
Canonical Gnu Mcafee and 2 more
Products
Ubuntu Linux Glibc Web Gateway and 4 more
CVE-2019-8457

sqlite: heap out-of-bound read in function rtreenode()

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.

CVSS 3.1 · 9.8 Critical EPSS 45.4% KEV · Not listed
Vendors
Canonical Fedoraproject Opensuse and 2 more
Products
Ubuntu Linux Fedora Leap and 2 more
CVE-2019-6111

openssh: Improper validation of object names allows malicious server to overwrite files via scp client

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

CVSS 3.1 · 5.9 Medium EPSS 58.2% KEV · Not listed
Vendors
Apache Canonical Debian and 7 more
Products
Mina Sshd Ubuntu Linux Debian Linux and 24 more
CVE-2019-6109

openssh: Missing character encoding in progress display allows for spoofing of scp client output

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.

CVSS 3.1 · 6.8 Medium EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 25 more
CVE-2019-5435

curl: Integer overflows in curl_url_set() function

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.

CVSS 3.0 · 3.7 Low EPSS 5.7% KEV · Not listed
Vendors
Haxx Redhat
Products
Curl Jboss Core Services
CVE-2019-5188

e2fsprogs: Out-of-bounds write in e2fsck/rehash.c

A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian E2fsprogs Project and 4 more
Products
Ubuntu Linux Debian Linux E2fsprogs and 7 more
CVE-2019-5094

e2fsprogs: Crafted ext4 partition leads to out-of-bounds write

An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian E2fsprogs Project and 3 more
Products
Ubuntu Linux Debian Linux E2fsprogs and 5 more