Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2015-5300

ntp: MITM attacker can force ntpd to make a step larger than the panic threshold

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).

CVSS 3.0 · 7.5 High EPSS 9.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 18 more
CVE-2017-7869

gnutls: Out-of-bounds write related to the cdk_pkt_read function (GNUTLS-SA-2017-3)

GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Gnu Redhat
Products
Gnutls Enterprise Linux
CVE-2015-5293

RHEV: When "boot protocol" is set to None on an interface, interface still gets IPv6 address

Red Hat Enterprise Virtualization Manager 3.6 and earlier gives valid SLAAC IPv6 addresses to interfaces when "boot protocol" is set to None, which might allow remote attackers to communicate with a system designated to be unreachable.

CVSS 3.0 · 5.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Enterprise Virtualization Manager
CVE-2016-4445

setroubleshoot: insecure use of commands.getstatusoutput in sealert

The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name, related to executing external commands with the commands.getstatusoutput function.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat Setroubleshoot Project
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node and 3 more
CVE-2017-1000254

curl: FTP PWD response parser out of bounds read

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.

CVSS 3.0 · 7.5 High EPSS 8.1% KEV · Not listed
Vendors
Haxx Redhat
Products
Libcurl Jboss Core Services Rhel Software Collections
CVE-2016-10159

php: Integer overflow in phar_parse_pharfile

Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive.

CVSS 3.1 · 7.5 High EPSS 7.6% KEV · Not listed
Vendors
Debian Php Redhat
Products
Debian Linux Php Rhel Software Collections
CVE-2014-3250

puppet: certificates could be honored even when revoked

The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Puppet Redhat
Products
Http Server Puppet Linux
CVE-2015-5195

ntp: ntpd crash when processing config commands with statistics type

ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.

CVSS 3.0 · 7.5 High EPSS 8.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 6 more
CVE-2015-5739

golang: HTTP request smuggling in net/http library

The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."

CVSS 3.0 · 9.8 Critical EPSS 9.6% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Enterprise Linux and 4 more
CVE-2015-5740

golang: HTTP request smuggling in net/http library

The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.

CVSS 3.0 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Enterprise Linux and 4 more
CVE-2015-5194

ntp: crash with crafted logconfig configuration command

The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.

CVSS 3.0 · 7.5 High EPSS 6.5% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2016-10200

kernel: l2tp: Race condition in the L2TPv3 IP encapsulation feature

Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Google Linux Redhat
Products
Android Linux Kernel Enterprise Linux and 3 more
CVE-2015-5164

Satellite6: python pickle() processing problem in pulp

The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp.

CVSS 3.0 · 7.2 High EPSS 4.0% KEV · Not listed
Vendors
Pulpproject Redhat
Products
Qpid Satellite
CVE-2017-7550

ansible: jenkins_plugin module exposes passwords in remote host logs

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Redhat
Products
Ansible Enterprise Linux Server Rhel Extras Other
CVE-2014-7813

CFME: rails .to_sym symbol DoS

Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym rails function and lack of garbage collection of inserted symbols.

CVSS 3.0 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Cloudforms 3.0 Management Engine
CVE-2016-7426

ntp: Client rate limiting and server responses

NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.

CVSS 3.1 · 7.5 High EPSS 12.4% KEV · Not listed
Vendors
Canonical Hpe Ntp and 1 more
Products
Ubuntu Linux Hpux-ntp Ntp and 7 more
CVE-2014-8163

Satellite5: upload_crash_file and upload_result directory traversal

Directory traversal vulnerability in the XMLRPC interface in Red Hat Satellite 5.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Satellite