Export limit exceeded: 11555 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 24818 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2018-10237

guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

CVSS 3.1 · 5.9 Medium EPSS 8.4% KEV · Not listed
Vendors
Google Oracle Redhat
Products
Guava Banking Payments Communications Ip Service Activator and 18 more
CVE-2018-10194

ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c

The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Artifex Canonical Debian and 1 more
Products
Ghostscript Ubuntu Linux Debian Linux and 7 more
CVE-2018-10184

haproxy: Heap buffer overflow in mux_h2.c:h2_process_demux() can allow attackers to cause a denial of service

An issue was discovered in HAProxy before 1.8.8. The incoming H2 frame length was checked against the max_frame_size setting instead of being checked against the bufsize. The max_frame_size only applies to outgoing traffic and not to incoming, so if a large enough frame size is advertised in the SETTINGS frame, a wrapped frame will be defragmented into a temporary allocated buffer where the second fragment may overflow the heap by up to 16 kB. It is very unlikely that this can be exploited for code execution given that buffers are very short lived and their addresses not realistically predictable in production, but the likelihood of an immediate crash is absolutely certain.

CVSS 3.0 · 7.5 High EPSS 8.1% KEV · Not listed
Vendors
Haproxy Redhat
Products
Haproxy Enterprise Linux Openshift and 1 more
CVE-2018-10177

ImageMagick: Infinite loop in coders/png.c:ReadOneMNGImage() allows attackers to cause a denial of service via crafted MNG file

In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng file.

CVSS 3.0 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Imagemagick Redhat
Products
Ubuntu Linux Imagemagick Enterprise Linux
CVE-2018-10120

libreoffice: Out of bounds write in filter/ww8/ww8toolbar.cxx:SwCTBWrapper class allows for denial of service with crafted document

The SwCTBWrapper::Read function in sw/source/filter/ww8/ww8toolbar.cxx in LibreOffice before 5.4.6.1 and 6.x before 6.0.2.1 does not validate a customizations index, which allows remote attackers to cause a denial of service (heap-based buffer overflow with write access) or possibly have unspecified other impact via a crafted document that contains a certain Microsoft Word record.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Libreoffice and 1 more
Products
Ubuntu Linux Debian Linux Libreoffice and 4 more
CVE-2018-10119

libreoffice: Use-after-free in sdstor/stgstrms.cxx:StgSmallStrm class allows for denial of service with crafted document

sot/source/sdstor/stgstrms.cxx in LibreOffice before 5.4.5.1 and 6.x before 6.0.1.1 uses an incorrect integer data type in the StgSmallStrm class, which allows remote attackers to cause a denial of service (use-after-free with write access) or possibly have unspecified other impact via a crafted document that uses the structured storage ole2 wrapper file format.

CVSS 3.0 · 7.8 High EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Libreoffice and 1 more
Products
Ubuntu Linux Debian Linux Libreoffice and 4 more
CVE-2018-1002200

plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

CVSS 3.0 · 5.5 Medium EPSS 11.6% KEV · Not listed
Vendors
Codehaus-plexus Debian Redhat
Products
Plexus-archiver Debian Linux Enterprise Linux and 3 more
CVE-2018-1002105

kubernetes: authentication/authorization bypass in the handling of non-101 responses

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.

CVSS 3.0 · 9.8 Critical EPSS 87.0% KEV · Not listed
Vendors
Kubernetes Netapp Redhat
Products
Kubernetes Trident Openshift and 1 more
CVE-2018-1002102

Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Kubernetes Redhat
Products
Fedora Kubernetes Openshift
CVE-2018-1002100

kubernetes: Kubectl copy doesn't check for paths outside of it's destination directory

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.

CVSS 3.0 · 4.2 Medium EPSS 1.6% KEV · Not listed
Vendors
Kubernetes Redhat
Products
Kubernetes Openshift
CVE-2018-1000997

jenkins: Path traversal vulnerability in Stapler allowed accessing internal data

A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.

CVSS 3.0 · 6.5 Medium EPSS 3.3% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2018-1000878

libarchive: Use after free in RAR decoder resulting in a denial of service

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c that can result in Crash/DoS - it is unknown if RCE is possible. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.

CVSS 3.1 · 8.8 High EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 6 more
CVE-2018-1000877

libarchive: Double free in RAR decoder resulting in a denial of service

libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decoder - libarchive/archive_read_support_format_rar.c, parse_codes(), realloc(rar->lzss.window, new_size) with new_size = 0 that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted RAR archive.

CVSS 3.1 · 8.8 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2018-1000876

binutils: integer overflow leads to heap-based buffer overflow in objdump

binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Gnu Redhat
Products
Ubuntu Linux Binutils Ansible Tower and 4 more
CVE-2018-1000873

jackson-modules-java8: DoS due to an Improper Input Validation

Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.

CVSS 3.1 · 6.5 Medium EPSS 4.8% KEV · Not listed
Vendors
Fasterxml Netapp Oracle and 1 more
Products
Jackson-modules-java8 Active Iq Unified Manager Clusterware and 4 more
CVE-2018-1000866

jenkins-plugin-script-security: Sandbox Bypass in finalize methods

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.59 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java, groovy-cps/lib/src/main/java/com/cloudbees/groovy/cps/SandboxCpsTransformer.java that allows attackers with Job/Configure permission, or unauthorized attackers with SCM commit privileges and corresponding pipelines based on Jenkinsfiles set up in Jenkins, to execute arbitrary code on the Jenkins master JVM

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Jenkins Redhat
Products
Pipeline\ Openshift Openshift Container Platform
CVE-2018-1000865

jenkins-plugin-script-security: Sandbox Bypass in finalize methods

A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed.

CVSS 3.0 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Jenkins Redhat
Products
Script Security Openshift Openshift Container Platform
CVE-2018-1000864

jenkins: potential denial of service through cron expression form validation (SECURITY-1193)

A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.

CVSS 3.0 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift Openshift Container Platform