Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,296

CVE-2019-20907

python: infinite loop in the tarfile module via crafted TAR archive

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

CVSS 3.1 · 5.5 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2019-9948

python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVSS 3.1 · 9.1 Critical EPSS 11.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 15 more
CVE-2019-9947

python: CRLF injection via the path part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVSS 3.1 · 5.4 Medium EPSS 5.3% KEV · Not listed
Vendors
Python Redhat
Products
Python Ansible Tower Enterprise Linux and 5 more
CVE-2019-9740

python: CRLF injection via the query part of the url passed to urlopen()

An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVSS 3.1 · 6.5 Medium EPSS 5.4% KEV · Not listed
Vendors
Python Redhat
Products
Python Ansible Tower Enterprise Linux and 5 more
CVE-2019-9636

python: Information Disclosure due to urlsplit improper NFKC normalization

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVSS 3.1 · 5.3 Medium EPSS 7.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2019-3863

libssh2: Integer overflow in user authenticate keyboard interactive allows out-of-bounds writes

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.

CVSS 3.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Debian Libssh2 Netapp and 2 more
Products
Debian Linux Libssh2 Ontap Select Deploy Administration Utility and 12 more
CVE-2019-3857

libssh2: Integer overflow in SSH packet processing channel resulting in out of bounds write

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 6.1% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 4 more
Products
Debian Linux Fedora Libssh2 and 14 more
CVE-2019-3856

libssh2: Integer overflow in keyboard interactive handling resulting in out of bounds write

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 6.1% KEV · Not listed
Vendors
Debian Fedoraproject Libssh2 and 4 more
Products
Debian Linux Fedora Libssh2 and 14 more
CVE-2019-3855

libssh2: Integer overflow in transport read resulting in out of bounds write

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVSS 3.1 · 8.8 High EPSS 9.3% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 5 more
Products
Xcode Debian Linux Fedora and 15 more
CVE-2018-0495

ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Gnupg and 2 more
Products
Ubuntu Linux Debian Linux Libgcrypt and 11 more
CVE-2021-22555

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space

CVSS 3.1 · 8.3 High EPSS 78.7% KEV · Listed
Vendors
Broadcom Linux Netapp and 1 more
Products
Fabric Operating System Linux Kernel Aff 500f and 40 more
CVE-2024-12085

Rsync: info leak via uninitialized stack contents

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

CVSS 3.1 · 7.5 High EPSS 8.6% KEV · Not listed
Vendors
Almalinux Archlinux Gentoo and 5 more
Products
Almalinux Arch Linux Linux and 26 more
CVE-2023-48161

giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function

Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Giflib Project Redhat
Products
Giflib Enterprise Linux Openjdk and 5 more
CVE-2023-20900

open-vm-tools: SAML token signature bypass

A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

CVSS 3.1 · 7.1 High EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 4 more
Products
Debian Linux Fedora Linux Kernel and 9 more
CVE-2020-24513

hw: information disclosure on some Intel Atom processors

Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Intel Redhat and 1 more
Products
Debian Linux Atom C3308 Atom C3336 and 74 more
CVE-2020-24512

hw: observable timing discrepancy in some Intel Processors

Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Debian Intel Netapp and 1 more
Products
Debian Linux Microcode Fas\/aff Bios and 8 more
CVE-2020-24511

hw: improper isolation of shared resources in some Intel Processors

Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Intel Netapp and 1 more
Products
Debian Linux Microcode Fas\/aff Bios and 8 more