Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 10244 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,244

Export CSV
CVE-2020-14573

OpenJDK: Incomplete interface type checks in Graal compiler (Hotspot, 8236867)

Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.1 · 3.7 Low EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2020-14562

OpenJDK: Excessive memory usage in ImageIO TIFF plugin (ImageIO, 8233239)

Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 · 5.3 Medium EPSS 5.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 9 more
CVE-2020-14409

SDL2: Integer overflow in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file

SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Libsdl and 1 more
Products
Debian Linux Fedora Simple Directmedia Layer and 1 more
CVE-2020-14400

libvncserver: byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint16_t pointers in libvncserver/translate.c. NOTE: Third parties do not consider this to be a vulnerability as there is no known path of exploitation or cross of a trust boundary

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Libvncserver Project and 1 more
Products
Ubuntu Linux Debian Linux Libvncserver and 1 more
CVE-2020-14399

libvncserver: byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly "no trust boundary crossed.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Libvncserver Project and 1 more
Products
Ubuntu Linux Debian Linux Libvncserver and 1 more
CVE-2020-14398

libvncserver: an improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c

An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Libvnc Project and 2 more
Products
Ubuntu Linux Debian Linux Libvncserver and 13 more
CVE-2020-14393

perl-dbi: Buffer overflow on an overlong DBD class name

A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string longer than 300 characters could cause an out-of-bounds write, affecting the availability of the service or integrity of data.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Opensuse and 1 more
Products
Debian Linux Fedora Leap and 1 more
CVE-2020-14392

perl-dbi: Memory corruption in XS functions when Perl stack is reallocated

An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2020-14386

kernel: memory corruption in net/packet/af_packet.c leads to elevation of privilege

A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS 3.1 · 6.7 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 4 more
CVE-2020-14385

kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt

A flaw was found in the Linux kernel before 5.9-rc4. A failure of the file system metadata validator in XFS can cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt. This can lead to the filesystem being shutdown, or otherwise rendered inaccessible until it is remounted, leading to a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 4 more
CVE-2020-14365

ansible: dnf module install packages with no GPG signature

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Ansible Engine Ansible Tower and 2 more
CVE-2020-14364

QEMU: usb: out-of-bounds r/w access issue while processing usb packets

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.

CVSS 3.1 · 5.0 Medium EPSS 5.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2020-14356

kernel: Use After Free vulnerability in cgroup BPF component

A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 8 more