Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2017-12988

tcpdump: Buffer over-read in print-telnet.c:telnet_parse() in telnet parser

The telnet parser in tcpdump before 4.9.2 has a buffer over-read in print-telnet.c:telnet_parse().

CVSS 3.0 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2016-5177

chromium-browser: use after free in v8

Use-after-free vulnerability in V8 in Google Chrome before 53.0.2785.143 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via unknown vectors.

CVSS 3.0 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 5 more
CVE-2015-0226

wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487)

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.

CVSS 3.0 · 7.5 High EPSS 5.5% KEV · Not listed
Vendors
Apache Redhat
Products
Wss4j Jboss Amq Jboss Data Grid and 4 more
CVE-2015-0238

OpenShift: selinux-policy privilege escalation to reveal process listing

selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack.

CVSS 3.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift
CVE-2017-14502

libarchive: Off-by-one error in the read_header function

read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header.

CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Libarchive Redhat
Products
Libarchive Enterprise Linux
CVE-2017-13005

tcpdump: Buffer over-read in print-nfs.c:xid_map_enter() in NFS parser

The NFS parser in tcpdump before 4.9.2 has a buffer over-read in print-nfs.c:xid_map_enter().

CVSS 3.0 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2016-4446

setroubleshoot-plugins: insecure commands.getoutput use in the allow_execstack plugin

The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filename, related to the commands.getoutput function.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat Setroubleshoot Project
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node and 3 more
CVE-2016-7985

tcpdump: multiple overflow issues in protocol decoding

The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print().

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2016-10166

gd: Unsigned integer underflow _gdContributionsAlloc()

Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable.

CVSS 3.0 · 9.8 Critical EPSS 10.7% KEV · Not listed
Vendors
Libgd Redhat
Products
Libgd Rhel Software Collections
CVE-2014-3706

ovirt-engine: connection does not validate certificate attributes.

ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates.

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Mrg
CVE-2017-15114

rhosp-director: Passwordless access for non-libvirt related services when using shared certificate authority

When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority as all non-libvirtd services. As no additional authentication is configured this allows these services to connect to libvirtd (which is equivalent to root access). If a vulnerability exists in another service it could, combined with this flaw, be exploited to escalate privileges to gain control over compute nodes.

CVSS 3.0 · 8.1 High EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Openstack Platform
CVE-2016-7983

tcpdump: multiple overflow issues in protocol decoding

The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print().

CVSS 3.0 · 9.8 Critical EPSS 3.9% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2014-9474

mpfr: buffer overflow in mpfr_strtofr

Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.

CVSS 3.0 · 9.8 Critical EPSS 4.5% KEV · Not listed
Vendors
Mpfr Redhat
Products
Gnu Mpfr Rhel Els
CVE-2015-1820

rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection responses

REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.

CVSS 3.0 · 9.8 Critical EPSS 4.3% KEV · Not listed
Vendors
Redhat Rest-client Project
Products
Cloudforms Managementengine Satellite Satellite Capsule and 1 more
CVE-2017-5483

tcpdump: multiple overflow issues in protocol decoding

The SNMP parser in tcpdump before 4.9.0 has a buffer overflow in print-snmp.c:asn1_parse().

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2017-13078

wpa_supplicant: Reinstallation of the group key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-14063

async-http-client: Invalid URL parsing with '?'

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.

CVSS 3.0 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Asynchttpclient Project Redhat
Products
Async-http-client Jboss Fuse
CVE-2016-5411

QCI: creates world readable /var/lib/ovirt-engine/setup/engine-DC-config.py contains sensitive password

/var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat QuickStart Cloud Installer (QCI) before 1.0 GA is created world readable and contains the root password of the deployed system.

CVSS 3.0 · 9.8 Critical EPSS 2.3% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Quickstart Cloud Installer
CVE-2016-1000220

kibana: XSS vulnerability ESA-2016-03

Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.

CVSS 3.0 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Elastic Redhat
Products
Kibana Openshift