Export limit exceeded: 17087 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,087

Export CSV
CVE-2020-10688

RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Fuse Jboss Enterprise Application Platform and 4 more
CVE-2020-10687

Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in HTTP requests

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.

CVSS 3.1 · 4.8 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Fuse and 3 more
CVE-2020-10663

rubygem-json: Unsafe object creation vulnerability in JSON

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

CVSS 3.1 · 7.5 High EPSS 6.8% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 4 more
Products
Macos Debian Linux Fedora and 7 more
CVE-2020-10135

Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks

Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.

CVSS 3.1 · 5.4 Medium EPSS 2.4% KEV · Not listed
Vendors
Bluetooth Opensuse Redhat
Products
Bluetooth Core Leap Enterprise Linux
CVE-2020-10018

webkitgtk: Use-after-free issue in accessibility/AXObjectCache.cpp

WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue has been fixed in 2.28.0 with improved memory handling.

CVSS 3.1 · 9.8 Critical EPSS 5.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2020-10001

cups: access to uninitialized buffer in ipp.c

An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave. A malicious application may be able to read restricted memory.

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Apple Debian Redhat
Products
Mac Os X Debian Linux Enterprise Linux
CVE-2020-0603

dotnet: Memory Corruption in SignalR

A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.

CVSS 3.1 · 8.8 High EPSS 22.6% KEV · Not listed
Vendors
Microsoft Redhat
Products
Asp.net Core Enterprise Linux Enterprise Linux Eus and 1 more
CVE-2020-0569

qt: files placed by attacker can influence the working directory and lead to malicious code execution

Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated user to potentially enable denial of service via local access.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Intel and 3 more
Products
Ubuntu Linux Debian Linux 7265 and 24 more
CVE-2020-0556

bluez: Improper access control in subsystem could result in privilege escalation and DoS

Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access

CVSS 3.1 · 7.1 High EPSS 1.0% KEV · Not listed
Vendors
Bluez Canonical Debian and 2 more
Products
Bluez Ubuntu Linux Debian Linux and 2 more
CVE-2020-0543

hw: Special Register Buffer Data Sampling (SRBDS)

Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Intel and 4 more
Products
Ubuntu Linux Fedora Celeron 1000m and 721 more
CVE-2020-0466

kernel: use after free in eventpoll.c may lead to escalation of privilege

In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147802478References: Upstream kernel

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Android Enterprise Linux Rhel Aus and 5 more
CVE-2020-0465

kernel: out of bounds write in hid-multitouch.c may lead to escalation of privilege

In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-162844689References: Upstream kernel

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Android Enterprise Linux Rhel Extras Rt
CVE-2020-0452

libexif: out of bounds write due to an integer overflow in exif-entry.c

In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a third party app used this library to process remote image data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-159625731

CVSS 3.1 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Fedoraproject Google Redhat
Products
Fedora Android Enterprise Linux and 2 more
CVE-2020-0444

kernel: bad kfree in auditfilter.c may lead to escalation of privilege

In audit_free_lsm_field of auditfilter.c, there is a possible bad kfree due to a logic error in audit_data_to_entry. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150693166References: Upstream kernel

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Android Enterprise Linux Rhel Eus
CVE-2020-0431

kernel: possible out of bounds write in kbd_keycode of keyboard.c

In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-144161459

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Google Opensuse Redhat
Products
Android Leap Enterprise Linux
CVE-2020-0427

kernel: out-of-bounds reads in pinctrl subsystem.

In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Android Leap and 3 more
CVE-2020-0404

kernel: avoid cyclic entity chains due to malformed USB descriptors

In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-111893654References: Upstream kernel

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Oracle Redhat
Products
Android Communications Cloud Native Core Binding Support Function Communications Cloud Native Core Network Exposure Function and 2 more