Export limit exceeded: 17086 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,086

Export CSV
CVE-2019-0217

httpd: mod_auth_digest: access control bypass due to race condition

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

CVSS 3.1 · 7.5 High EPSS 16.4% KEV · Not listed
Vendors
Apache Canonical Debian and 5 more
Products
Http Server Ubuntu Linux Debian Linux and 13 more
CVE-2019-0215

httpd: mod_ssl: access control bypass when using per-location client certification authentication

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

CVSS 3.0 · 7.5 High EPSS 10.4% KEV · Not listed
Vendors
Apache Fedoraproject Redhat
Products
Http Server Fedora Enterprise Linux
CVE-2019-0205

thrift: Endless loop when feed with specific input data

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.

CVSS 3.1 · 7.5 High EPSS 9.2% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Thrift Communications Cloud Native Core Network Slice Selection Function Enterprise Linux Server and 6 more
CVE-2019-0203

subversion: NULL pointer dereference in svnserve leading to an unauthenticated remote DoS

In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.

CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Apache Redhat
Products
Subversion Enterprise Linux
CVE-2019-0197

httpd: mod_http2: possible crash on late upgrade

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

CVSS 3.1 · 4.2 Medium EPSS 8.3% KEV · Not listed
Vendors
Apache Canonical Fedoraproject and 3 more
Products
Http Server Ubuntu Linux Fedora and 9 more
CVE-2019-0196

httpd: mod_http2: read-after-free on a string compare

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.

CVSS 3.0 · 5.3 Medium EPSS 19.3% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Http Server Ubuntu Linux Debian Linux and 2 more
CVE-2019-0161

edk2: stack overflow in XHCI causing denial of service

Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local access.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Tianocore
Products
Enterprise Linux Edk Ii
CVE-2019-0160

edk2: Buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media

Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Opensuse Redhat and 1 more
Products
Fedora Leap Enterprise Linux and 5 more
CVE-2019-0155

hw: Intel GPU blitter manipulation can allow for arbitrary kernel memory write

Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and E-2200 Processor Families; Intel(R) Graphics Driver for Windows before 26.20.100.6813 (DCH) or 26.20.100.6812 and before 21.20.x.5077 (aka15.45.5077), i915 Linux Driver for Intel(R) Processor Graphics before versions 5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, 4.4.201 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Intel Redhat
Products
Ubuntu Linux Atom X5-e3930 Atom X5-e3930 Firmware and 713 more
CVE-2019-0154

hw: Intel GPU Denial Of Service while accessing MMIO in lower power state

Insufficient access control in subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100 Processor Families may allow an authenticated user to potentially enable denial of service via local access.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Intel Redhat
Products
Ubuntu Linux Atom X5-a3930 Atom X5-a3930 Firmware and 299 more
CVE-2019-0136

kernel: insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver may allow an unauthenticated user to potentially enable DoS via adjacent access

Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may allow an unauthenticated user to potentially enable denial of service via adjacent access.

CVSS 3.1 · 4.7 Medium EPSS 4.1% KEV · Not listed
Vendors
Google Intel Linux and 2 more
Products
Chrome Os Proset\/wireless Wifi Linux Kernel and 5 more
CVE-2019-0117

hw: Intel SGX information leak

Insufficient access control in protected memory subsystem for Intel(R) SGX for 6th, 7th, 8th, 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Xeon(R) Processor E3-1500 v5, v6 Families; Intel(R) Xeon(R) E-2100 & E-2200 Processor Families with Intel(R) Processor Graphics may allow a privileged user to potentially enable information disclosure via local access.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Intel Redhat
Products
Core I5-7200u Core I5-7200u Firmware Core I5-7260u and 328 more
CVE-2018-9568

kernel: Memory corruption due to incorrect socket cloning

In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-113509306. References: Upstream kernel.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Google Linux and 1 more
Products
Ubuntu Linux Android Linux Kernel and 13 more
CVE-2018-9517

kernel: l2tp: Race condition between pppol2tp_session_create() and l2tp_eth_create()

In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-38159931.

CVSS 3.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Android Enterprise Linux Rhel Extras Rt
CVE-2018-9516

kernel: HID: debug: Buffer overflow in hid_debug_events_read() in drivers/hid/hid-debug.c

In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-71361580.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Google and 1 more
Products
Ubuntu Linux Debian Linux Android and 2 more
CVE-2018-9363

kernel: Buffer overflow in hidp_process_report

In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-65853588 References: Upstream kernel.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Google and 2 more
Products
Ubuntu Linux Debian Linux Android and 3 more
CVE-2018-9305

exiv2: out of bounds read in IptcData::printStructure in iptc.c

In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the "== 0x1c" case.

CVSS 3.0 · 8.1 High EPSS 1.9% KEV · Not listed
Vendors
Exiv2 Redhat
Products
Exiv2 Enterprise Linux
CVE-2018-9304

exiv2: divide by zero in BigTiffImage::printIFD in bigtiffimage.cpp

In Exiv2 0.26, a divide by zero in BigTiffImage::printIFD in bigtiffimage.cpp could result in denial of service.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Exiv2 Redhat
Products
Exiv2 Enterprise Linux
CVE-2018-9303

exiv2: assertion failure in BigTiffImage::readData in bigtiffimage.cpp

In Exiv2 0.26, an assertion failure in BigTiffImage::readData in bigtiffimage.cpp results in an abort.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Exiv2 Redhat
Products
Exiv2 Enterprise Linux