Export limit exceeded: 24818 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2018-1089

389-ds-base: ns-slapd crash via large filter value in ldapsearch

389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.

CVSS 3.0 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux 389 Directory Server Enterprise Linux and 3 more
CVE-2018-1088

glusterfs: Privilege escalation via gluster_shared_storage when snapshot scheduling is enabled

A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.

CVSS 3.1 · 8.1 High EPSS 5.5% KEV · Not listed
Vendors
Debian Opensuse Redhat
Products
Debian Linux Leap Enterprise Linux and 5 more
CVE-2018-1087

Kernel: KVM: error in exception handling leads to wrong debug stack value

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.

CVSS 3.0 · 8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 13 more
CVE-2018-1086

pcs: Debug parameter removal bypass, allowing information disclosure

pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.

CVSS 3.0 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Clusterlabs Debian Redhat
Products
Pacemaker Command Line Interface Debian Linux Enterprise Linux and 1 more
CVE-2018-1085

openshift-ansible: Incorrectly quoted values in etcd.conf causes disabling of SSL client certificate authentication

openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCD_CLIENT_CERT_AUTH and ETCD_PEER_CLIENT_CERT_AUTH in etcd.conf result in etcd being configured to allow remote users to connect without any authentication if they can access the etcd server bound to the network on the master nodes. An attacker could use this flaw to read and modify all the data about the Openshift cluster in the etcd datastore, potentially adding another compute node, or bringing down the entire cluster.

CVSS 3.0 · 9 Critical EPSS 2.3% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform
CVE-2018-1083

zsh: Stack-based buffer overflow in gen_matches_files() at compctl.c

Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 4 more
CVE-2018-1080

pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

CVSS 3.0 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Dogtagpki Redhat
Products
Dogtagpki Enterprise Linux
CVE-2018-1079

pcs: Privilege escalation via authorized user malicious REST call

pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.

CVSS 3.0 · 8.7 High EPSS 1.1% KEV · Not listed
Vendors
Clusterlabs Redhat
Products
Pacemaker Command Line Interface Enterprise Linux
CVE-2018-1077

spacewalk: XML External Entity (XXE) on Spacewalk APIs

Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server.

CVSS 3.0 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Satellite Spacewalk
CVE-2018-1075

ovirt-engine: Unfiltered password when choosing manual db provisioning

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.

CVSS 3.0 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Ovirt Redhat
Products
Ovirt Rhev Manager
CVE-2018-1074

ovirt-engine: API exposes power management credentials to administrators

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.

CVSS 3.0 · 7.7 High EPSS 1.4% KEV · Not listed
Vendors
Ovirt Redhat
Products
Ovirt Enterprise Virtualization Rhev Manager
CVE-2018-1073

ovirt-engine: account enumeration through login to web console

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts.

CVSS 3.1 · 5.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Ovirt Redhat
Products
Ovirt-engine Enterprise Linux Virtualization and 1 more
CVE-2018-1072

ovirt-engine-setup: unfiltered db password in engine-backup log

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provision*db", the database username and password were logged in cleartext. Sharing the provisioning log might inadvertently leak database passwords.

CVSS 3.0 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Ovirt Redhat
Products
Ovirt Enterprise Virtualization Manager Rhev Manager
CVE-2018-1071

zsh: Stack-based buffer overflow in exec.c:hashcmd()

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 4 more
CVE-2018-1070

Routing: Malicous Service configuration can bring down routing for an entire shard.

routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which can cause an entire shard to be brought down. A malicious user can use this vulnerability to cause a Denial of Service attack for other users of the router shard.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform
CVE-2018-1069

Networking: container networking does not prevent access to network resources

Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. An attacker could override the UserId and GroupId for GlusterFS and NFS to read and write any data on the network filesystem.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2018-1068

kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c

A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 14 more
CVE-2018-1067

undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)

In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.

CVSS 3.1 · 6.1 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd and 3 more
CVE-2018-1066

kernel: Null pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() when empty TargetInfo is returned in NTLMSSP setup negotiation response allowing to crash client's kernel

The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allows an attacker controlling a CIFS server to kernel panic a client that has this server mounted, because an empty TargetInfo field in an NTLMSSP setup negotiation response is mishandled during session recovery.

CVSS 3.0 · 6.5 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 1 more