Export limit exceeded: 17087 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2020-28915

kernel: out-of-bounds read in fbcon_get_font function

A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhev Hypervisor
CVE-2020-28896

mutt: Incorrect handling of invalid initial IMAP responses could lead to an authentication attempt over unencrypted connection

Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response was invalid. The connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.

CVSS 3.1 · 5.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Debian Mutt Neomutt and 1 more
Products
Debian Linux Mutt Neomutt and 1 more
CVE-2020-28852

golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag

In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Golang Redhat
Products
Text Acm Enterprise Linux and 2 more
CVE-2020-28851

golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension

In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Enterprise Linux and 2 more
CVE-2020-28493

Regular Expression Denial of Service (ReDoS)

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

CVSS 3.1 · 5.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Fedoraproject Palletsprojects Redhat
Products
Fedora Jinja Enterprise Linux and 1 more
CVE-2020-28374

kernel: SCSI target (LIO) write to any block on ILO backstore

In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore.

CVSS 3.1 · 8.1 High EPSS 6.6% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 6 more
CVE-2020-28367

Arbitrary code execution via the go command with cgo in cmd/go

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Golang Redhat
Products
Go Devtools Enterprise Linux and 1 more
CVE-2020-28366

Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 1 more
Products
Fedora Go Cloud Insights Telegraf Agent and 4 more
CVE-2020-27918

webkitgtk: Use-after-free leading to arbitrary code execution

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes 12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 2 more
Products
Icloud Ipados Iphone Os and 10 more
CVE-2020-27846

crewjam/saml: authentication bypass in saml authentication

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 9.8 Critical EPSS 4.9% KEV · Not listed
Vendors
Fedoraproject Grafana Redhat and 1 more
Products
Fedora Grafana Enterprise Linux and 4 more
CVE-2020-27845

openjpeg: heap-based buffer overflow in functions opj_pi_next_rlcp, opj_pi_next_rpcl and opj_pi_next_lrcp in openjp2/pi.c

There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Oracle and 2 more
Products
Debian Linux Fedora Outside In Technology and 2 more
CVE-2020-27843

openjpeg: out-of-bounds read in opj_t2_encode_packet function in openjp2/t2.c

A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability.

CVSS 3.1 · 5.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Fedoraproject Oracle and 2 more
Products
Debian Linux Fedora Outside In Technology and 2 more
CVE-2020-27842

openjpeg: null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c

There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Oracle and 2 more
Products
Debian Linux Extra Packages For Enterprise Linux Fedora and 8 more
CVE-2020-27836

cluster-ingress-operator: changes to loadBalancerSourceRanges overwritten by operator

A flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source ranges could allow an attacker to access resources that would otherwise be restricted to specified IP ranges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability..

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Openshift Openshift Container Platform
CVE-2020-27835

kernel: child process is able to access parent mm through hfi dev file handle

A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Infiniband Hfi1 Driver Enterprise Linux
CVE-2020-27828

jasper: Heap-based buffer overflow in cp_create() in jpc_enc.c

There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Jasper Project Redhat
Products
Fedora Jasper Enterprise Linux