Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 328

CVE-2023-28322

curl: more POST-after-PUT confusion

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

CVSS 3.1 · 5.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Apple Fedoraproject Haxx and 2 more
Products
Macos Fedora Curl and 14 more
CVE-2023-50868

bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

CVSS 3.1 · 7.5 High EPSS 74.3% KEV · Not listed
Vendors
Debian Fedoraproject Isc and 3 more
Products
Debian Linux Fedora Bind and 16 more
CVE-2024-40896

libxml2: XXE vulnerability

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

CVSS 3.1 · 9.1 Critical EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat Xmlsoft
Products
H300s H300s Firmware H410c and 12 more
CVE-2020-11023

Potential XSS vulnerability in jQuery

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS 3.1 · 6.9 Medium EPSS 84.9% KEV · Listed
Vendors
Debian Drupal Fedoraproject and 5 more
Products
Debian Linux Drupal Fedora and 75 more
CVE-2022-0847

kernel: improper initialization of the "flags" member of the new pipe_buffer

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS 92.8% KEV · Listed
Vendors
Fedoraproject Linux Netapp and 4 more
Products
Fedora Linux Kernel H300e and 39 more
CVE-2022-0185

kernel: fs_context: heap overflow in legacy parameter handling

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.

CVSS 3.1 · 8.4 High EPSS 25.2% KEV · Listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel H300e H300e Firmware and 17 more
CVE-2023-0386

kernel: FUSE filesystem low-privileged user privileges escalation

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS 7.9% KEV · Listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 13 more
CVE-2022-45888

kernel: use-after-free due to race condition in drivers/char/xillybus/xillyusb.c

An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of a USB device.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Netapp
Products
Linux Kernel H300s H300s Firmware and 8 more
CVE-2024-56171

libxml2: Use-After-Free in libxml2

libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat Xmlsoft
Products
Active Iq Unified Manager H300s H300s Firmware and 25 more
CVE-2021-42374

busybox: out-of-bounds read in unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed

An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Busybox Fedoraproject Netapp
Products
Busybox Fedora Cloud Backup and 16 more
CVE-2019-2215

kernel: Use-after-free in binder.c

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095

CVSS 3.1 · 7.8 High EPSS 72.1% KEV · Listed
Vendors
Canonical Debian Google and 2 more
Products
Ubuntu Linux Debian Linux Android and 142 more
CVE-2021-22600

Double Free in net/packet/af_packet.c leading to priviledge escalation

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755

CVSS 3.1 · 6.6 Medium EPSS 6.6% KEV · Listed
Vendors
Debian Linux Netapp
Products
Debian Linux Linux Kernel 8300 and 17 more
CVE-2018-25032

zlib: A flaw found in zlib when compressing (not decompressing) certain inputs

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

CVSS 3.1 · 7.5 High EPSS 51.7% KEV · Not listed
Vendors
Apple Azul Debian and 10 more
Products
Mac Os X Macos Zulu and 44 more
CVE-2023-32257

Session race condition remote code execution vulnerability

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.

CVSS 3.1 · 8.1 High EPSS 2.4% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel H300s H410s and 4 more
CVE-2022-26490

kernel: potential buffer overflows in EVT_TRANSACTION in st21nfca

st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 16 more
CVE-2023-26545

kernel: mpls: double free on sysctl allocation failure

In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel H300s and 12 more
CVE-2020-13817

ntp: ntpd using highly predictable transmit timestamps could result in time change or DoS

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.

CVSS 3.1 · 7.4 High EPSS 3.4% KEV · Not listed
Vendors
Fujitsu Netapp Ntp and 2 more
Products
M10-1 M10-1 Firmware M10-4 and 38 more
CVE-2023-38427

kernel: ksmbd: integer underflow and out-of-bounds read in deassemble_neg_contexts

An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemble_neg_contexts.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Linux Netapp
Products
Linux Kernel H300s H410s and 2 more
CVE-2023-28466

kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference

do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel H300s and 7 more