Export limit exceeded: 425863 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 10244 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,244

Export CSV
CVE-2018-6040

chromium-browser: content security policy bypass

Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content security policy via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6037

chromium-browser: insufficient user gesture requirements in autofill

Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with insufficient user gestures via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6035

chromium-browser: insufficient isolation of devtools from extensions

Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a crafted Chrome Extension.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6033

chromium-browser: race when opening downloaded files

Insufficient data validation in Downloads in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted Chrome Extension.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6032

chromium-browser: same origin bypass in shared worker

Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Chrome Enterprise Linux Desktop and 3 more
CVE-2018-6003

libtasn1: Stack exhaustion due to indefinite recursion during BER decoding

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Debian Fedoraproject Gnu
Products
Debian Linux Fedora Libtasn1
CVE-2018-5953

kernel: Information Exposure through dmesg data from a "software IO TLB" printk call

The swiotlb_print_info function in lib/swiotlb.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dmesg data from a "software IO TLB" printk call.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux
Products
Debian Linux Linux Kernel
CVE-2018-5950

mailman: Cross-site scripting (XSS) vulnerability in web UI

Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.

CVSS 3.1 · 6.1 Medium EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Gnu and 1 more
Products
Ubuntu Linux Debian Linux Mailman and 7 more
CVE-2018-5848

kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory corruption

In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len' argument can cause a buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Google Redhat
Products
Debian Linux Android Enterprise Linux and 5 more
CVE-2018-5819

LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp

An error within the "parse_sinar_ia()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Debian Libraw Redhat
Products
Debian Linux Libraw Ansible Tower and 1 more
CVE-2018-5818

LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp

An error within the "parse_rollei()" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop.

CVSS 3.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Debian Libraw Redhat
Products
Debian Linux Libraw Ansible Tower and 1 more
CVE-2018-5817

LibRaw: DoS in unpacked_load_raw function in internal/dcraw_common.cpp

A type confusion error within the "unpacked_load_raw()" function within LibRaw versions prior to 0.19.1 (internal/dcraw_common.cpp) can be exploited to trigger an infinite loop.

CVSS 3.0 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Debian Libraw
Products
Debian Linux Libraw
CVE-2018-5814

kernel: Race condition errors in USB over IP functionality can cause denial of service

In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux
Products
Ubuntu Linux Debian Linux Linux Kernel
CVE-2018-5808

LibRaw: stack-based buffer overflow in find_green() leads to arbitrary code execution

An error within the "find_green()" function (internal/dcraw_common.cpp) in LibRaw versions prior to 0.18.9 can be exploited to cause a stack-based buffer overflow and subsequently execute arbitrary code.

CVSS 3.0 · 8.8 High EPSS 2.8% KEV · Not listed
Vendors
Debian Libraw
Products
Debian Linux Libraw
CVE-2018-5803

kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service

In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length can be exploited to cause a kernel crash.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 6 more