Export limit exceeded: 17087 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2021-28662

squid: denial of service in HTTP response processing

An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.

CVSS 3.1 · 6.5 Medium EPSS 71.8% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2021-28652

squid: denial of service issue in Cache Manager

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.

CVSS 3.1 · 4.9 Medium EPSS 4.3% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2021-28651

squid: denial of service in URN processing

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption.

CVSS 3.1 · 7.5 High EPSS 7.4% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 2 more
Products
Debian Linux Fedora Cloud Manager and 2 more
CVE-2021-28650

gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (incomplete CVE-2020-36241 fix)

autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-36241.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Gnome Redhat
Products
Fedora Gnome-autoar Enterprise Linux
CVE-2021-28116

squid: out-of-bounds read in WCCP protocol data may lead to information disclosure

Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.

CVSS 3.1 · 3.7 Low EPSS 12.9% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2021-27928

mariadb: writable system variables allows a database user with SUPER privilege to execute arbitrary code as the system mysql user

A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.

CVSS 3.1 · 7.2 High EPSS 38.2% KEV · Not listed
Vendors
Debian Galeracluster Mariadb and 2 more
Products
Debian Linux Wsrep Mariadb and 5 more
CVE-2021-27918

golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Golang Redhat
Products
Go Enterprise Linux Openshift Container Storage and 1 more
CVE-2021-27365

kernel: heap buffer overflow in the iSCSI subsystem

An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Debian Linux Netapp and 2 more
Products
Debian Linux Linux Kernel Cloud Backup and 10 more
CVE-2021-27364

kernel: out-of-bounds read in libiscsi module

An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 11 more
CVE-2021-27363

kernel: iscsi: unrestricted access to sessions and handles

An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel Cloud Backup and 7 more
CVE-2021-27358

grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

CVSS 3.1 · 7.5 High EPSS 83.0% KEV · Not listed
Vendors
Grafana Netapp Redhat
Products
Grafana E-series Performance Analyzer Acm and 1 more
CVE-2021-27291

python-pygments: ReDoS in multiple lexers

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Debian Fedoraproject Pygments and 1 more
Products
Debian Linux Fedora Pygments and 3 more
CVE-2021-27290

nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Oracle Redhat Siemens and 1 more
Products
Graalvm Enterprise Linux Rhel Eus and 3 more
CVE-2021-27135

xterm: crash when processing combining characters

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

CVSS 3.1 · 9.8 Critical EPSS 7.9% KEV · Not listed
Vendors
Debian Fedoraproject Invisible-island and 1 more
Products
Debian Linux Fedora Xterm and 2 more
CVE-2021-26708

kernel: race conditions caused by wrong locking in net/vmw_vsock/af_vsock.c

A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support.

CVSS 3.1 · 7.0 High EPSS 1.6% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel 500f A250 and 10 more