Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,811

CVE-2018-14467

tcpdump: Buffer over-read in bgp_capabilities_print() in print-bgp.c

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Mac Os X Debian Linux Fedora and 3 more
CVE-2024-28180

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

CVSS 3.1 · 4.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Go-jose Project Redhat
Products
Fedora Go-jose Acm and 12 more
CVE-2018-16452

tcpdump: Resource exhaustion in smb_fdata() funtion in smbutil.c

The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2018-16451

tcpdump: Buffer over-read in print_trans() function in print-smb.c

The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN.

CVSS 3.1 · 9.8 Critical EPSS 4.0% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Mac Os X Debian Linux Fedora and 3 more
CVE-2018-16300

tcpdump: Resource exhaustion in bgp_attr_print() function in print-bgp.c

The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited recursion.

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2018-16230

tcpdump: Buffer over-read in bgp_attr_print() function in print-bgp.c

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Mac Os X Debian Linux Fedora and 3 more
CVE-2018-16228

tcpdump: Access to uninitialized buffer in print_prefix() function in print-hncp.c

The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 3 more
Products
Mac Os X Debian Linux Fedora and 3 more
CVE-2020-27827

lldp/openvswitch: denial of service via externally triggered memory leak

A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Fedoraproject Lldpd Project Openvswitch and 2 more
Products
Fedora Lldpd Openvswitch and 25 more
CVE-2019-15165

libpcap: Resource exhaustion during PHB header length validation

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Apple Canonical Debian and 5 more
Products
Ipados Iphone Os Mac Os X and 9 more
CVE-2024-34069

Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.

CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Debian Fedoraproject Palletsprojects and 1 more
Products
Debian Linux Fedora Werkzeug and 4 more
CVE-2021-33285

ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value in MFT records

In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not, the parsing of the records proceeds into the wild.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Advanced Virtualization and 2 more
CVE-2021-20197

binutils: Race window allows users to own arbitrary files

There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Gnu Netapp and 1 more
Products
Brocade Fabric Operating System Firmware Binutils Cloud Backup and 3 more
CVE-2021-3448

dnsmasq: fixed outgoing port used when --server is used with an interface name

A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.

CVSS 3.1 · 4 Medium EPSS 2.3% KEV · Not listed
Vendors
Fedoraproject Oracle Redhat and 1 more
Products
Fedora Communications Cloud Native Core Network Function Cloud Native Environment Enterprise Linux and 1 more