Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.9The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.Jan 4, 2021
- Medium6.1Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityKEVEPSS 32.9%Dec 28, 2020
- High7.5An issue was discovered in p11-kit 0.23.6 through 0.23.21.Dec 16, 2020
- High7.5An issue was discovered in p11-kit 0.21.1 through 0.23.21.Dec 16, 2020
- High7.5curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.Dec 14, 2020
- High7.5curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.Dec 14, 2020
- Low3.7A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make cu…Dec 14, 2020
- High7.5Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.Dec 14, 2020
- High7.8curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.Dec 14, 2020
- High7.5curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).Dec 14, 2020
- High7.8PEAR Archive_Tar Deserialization of Untrusted Data VulnerabilityKEVEPSS 84.6%Nov 19, 2020
- Critical9.8SaltStack Salt Shell Injection VulnerabilityKEVEPSS 99.6%Nov 6, 2020
- High8.8Google Chromium V8 Type Confusion VulnerabilityKEVEPSS 48.3%Nov 2, 2020
- Critical9.6Google Chrome FreeType Heap Buffer Overflow VulnerabilityKEVEPSS 63.9%Nov 2, 2020
- High7.2http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP reques…Sep 27, 2020
- Medium6.5GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.Sep 4, 2020
- Medium5.5Microsoft Netlogon Privilege Escalation VulnerabilityKEVEPSS 99.4%Aug 17, 2020
- High7.5In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks…Jul 13, 2020
- Medium6.1Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityKEVEPSS 76.6%Jun 8, 2020
- High7.5SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.Jun 6, 2020
- High7.4GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3).Jun 4, 2020
- Medium5.5ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.May 27, 2020
- High7.0ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.May 27, 2020
- Medium5.5SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.May 24, 2020
- High7.8json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.May 9, 2020