Search vulnerabilities

Expected end of text, found '–' (at char 11), (line:1, col:12)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,892

CVE-2020-13631

sqlite: Virtual table can be renamed into the name of one of its shadow tables

SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Broadcom Canonical and 6 more
Products
Icloud Ipados Iphone Os and 17 more
CVE-2020-13630

sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

CVSS 3.1 · 7.0 High EPSS 1.0% KEV · Not listed
Vendors
Apple Broadcom Canonical and 7 more
Products
Icloud Ipados Iphone Os and 18 more
CVE-2020-13529

systemd: DHCP FORCERENEW authentication not implemented can cause a system running the DHCP client to have its network reconfigured

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Netapp Redhat and 1 more
Products
Fedora Active Iq Unified Manager Cloud Backup and 2 more
CVE-2020-13434

sqlite: integer overflow in sqlite3_str_vappendf function in printf.c

SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Icloud Ipados Iphone Os and 13 more
CVE-2020-12062

openssh: scp can send duplicate responses to the server upon a utimes system call failure leading to overwrite of arbitrary files

The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Openbsd
Products
Openssh
CVE-2026-65141

Eval Injection Allowing Remote Code Execution in NVIDIA Isaac Lab

NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Isaac Lab
CVE-2020-8492

python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

CVSS 3.1 · 6.5 Medium EPSS 6.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2020-8315

python: unsafe dll loading in getpathp.c on Windows

In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Python
Products
Python
CVE-2020-8286

curl: Inferior OCSP verification

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 6 more
Products
Mac Os X Macos Debian Linux and 19 more
CVE-2020-8285

curl: Malicious FTP server can trigger stack overflow when CURLOPT_CHUNK_BGN_FUNCTION is used

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

CVSS 3.1 · 7.5 High EPSS 9.8% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 7 more
Products
Mac Os X Macos Debian Linux and 29 more
CVE-2020-8284

curl: FTP PASV command response can cause curl to connect to arbitrary host

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

CVSS 3.1 · 3.7 Low EPSS 3.9% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 7 more
Products
Mac Os X Macos Debian Linux and 28 more
CVE-2020-8177

curl: Incorrect argument check can allow remote servers to overwrite local files

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed
Vendors
Debian Fujitsu Haxx and 3 more
Products
Debian Linux M10-1 M10-1 Firmware and 16 more