Export limit exceeded: 425852 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 17086 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,086

Export CSV
CVE-2018-14650

sos-collector: incorrect permissions set on newly created files

It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Sos-collector Project
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Server and 4 more
CVE-2018-14649

ceph-iscsi-cli: rbd-target-api service runs in debug mode allowing for remote command execution

It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions.

CVSS 3.0 · 9.8 Critical EPSS 12.0% KEV · Not listed
Vendors
Redhat
Products
Ceph-iscsi-cli Ceph Storage Enterprise Linux Desktop and 2 more
CVE-2018-14648

389-ds-base: Mishandled search requests in servers/slapd/search.c:do_search() allows for denial of service

A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service.

CVSS 3.0 · 7.5 High EPSS 7.2% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux 389 Directory Server Enterprise Linux and 1 more
CVE-2018-14646

kernel: NULL pointer dereference in af_netlink.c:__netlink_ns_capable() allows for denial of service

The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file. A local attacker could exploit this when a net namespace with a netnsid is assigned to cause a kernel panic and a denial of service.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Enterprise Linux Desktop and 7 more
CVE-2018-14645

haproxy: Out-of-bounds read in HPACK decoder

A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.

CVSS 3.0 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Canonical Haproxy Redhat
Products
Ubuntu Linux Haproxy Enterprise Linux and 3 more
CVE-2018-14642

undertow: Infoleak in some circumstances where Undertow can serve data from a random buffer

An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests.

CVSS 3.1 · 5.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Single Sign On and 1 more
CVE-2018-14641

kernel: a bug in ip_frag_reasm() can cause a crash in ip_do_fragment()

A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3 inclusive, which can cause a later system crash in ip_do_fragment(). With certain non-default, but non-rare, configuration of a victim host, an attacker can trigger this crash remotely, thus leading to a remote denial-of-service.

CVSS 3.0 · 6.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2018-14638

389-ds-base: Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly

A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service.

CVSS 3.0 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Enterprise Linux Enterprise Linux Aus and 5 more
CVE-2018-14633

kernel: stack-based buffer overflow in chap_server_compute_md5() in iscsi target

A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable.

CVSS 3.1 · 7.0 High EPSS 8.7% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 8 more
CVE-2018-14625

kernel: use-after-free Read in vhost_transport_send_pkt

A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients.

CVSS 3.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 2 more
CVE-2018-14624

389-ds-base: Server crash through modify command with large DN

A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.

CVSS 3.0 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux 389 Directory Server Enterprise Linux and 6 more
CVE-2018-14622

libtirpc: Segmentation fault in makefd_xprt return value in svc_vc.c

A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections.

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Canonical Debian Libtirpc Project and 1 more
Products
Ubuntu Linux Debian Linux Libtirpc and 5 more
CVE-2018-14619

kernel: crash (possible privesc) in kernel crypto api.

A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This can cause the null skcipher to be freed while it is still in use leading to a local user being able to crash the system or possibly escalate privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2018-14600

libX11: Out of Bounds write in XListExtensions in ListExt.c

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution.

CVSS 3.1 · 8.1 High EPSS 9.2% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 1 more
CVE-2018-14599

libX11: Off-by-one error in XListExtensions in ListExt.c

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact.

CVSS 3.1 · 9.8 Critical EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 5 more
CVE-2018-14598

libX11: Crash on invalid reply in XListExtensions in ListExt.c

An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault).

CVSS 3.0 · 7.5 High EPSS 4.2% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2018-14553

gd: NULL pointer dereference in gdImageClone

gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).

CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2018-14526

wpa_supplicant: Unauthenticated EAPOL-Key decryption in wpa_supplicant

An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 1 more
CVE-2018-14498

libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service

get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.

CVSS 3.0 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Debian Fedoraproject Libjpeg-turbo and 3 more
Products
Debian Linux Fedora Libjpeg-turbo and 3 more