Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.5Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.EPSS 5.3%Dec 14, 2020
- High7.8curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.EPSS 1.3%Dec 14, 2020
- High7.5curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).EPSS 3.9%Dec 14, 2020
- High7.8PEAR Archive_Tar Deserialization of Untrusted Data VulnerabilityKEVEPSS 84.6%Nov 19, 2020
- Critical9.8SaltStack Salt Shell Injection VulnerabilityKEVEPSS 99.6%Nov 6, 2020
- High8.8Google Chromium V8 Type Confusion VulnerabilityKEVEPSS 48.3%Nov 2, 2020
- Critical9.6Google Chrome FreeType Heap Buffer Overflow VulnerabilityKEVEPSS 63.9%Nov 2, 2020
- High7.2http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP reques…EPSS 6.4%Sep 27, 2020
- Medium6.5GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.EPSS 3.0%Sep 4, 2020
- Medium5.5Microsoft Netlogon Privilege Escalation VulnerabilityKEVEPSS 99.4%Aug 17, 2020
- High7.5In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks…EPSS 3.0%Jul 13, 2020
- Medium6.1Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityKEVEPSS 76.6%Jun 8, 2020
- High7.5SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.EPSS 4.4%Jun 6, 2020
- High7.4GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3).EPSS 22.3%Jun 4, 2020
- Medium5.5ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.EPSS 0.6%May 27, 2020
- High7.0ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.EPSS 1.0%May 27, 2020
- Medium5.5SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.EPSS 1.0%May 24, 2020
- High7.8json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.EPSS 1.9%May 9, 2020
- High7.0A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out.EPSS 0.5%Apr 30, 2020
- Medium6.5SaltStack Salt Path Traversal VulnerabilityKEVEPSS 86.2%Apr 30, 2020
- Critical9.8SaltStack Salt Authentication Bypass VulnerabilityKEVEPSS 96.6%Apr 30, 2020
- Medium6.1JQuery Cross-Site Scripting (XSS) VulnerabilityKEVEPSS 84.9%Apr 29, 2020
- High7.5In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).EPSS 4.7%Apr 28, 2020
- High7.5SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initializat…EPSS 4.3%Apr 9, 2020
- High7.4GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS.EPSS 3.4%Apr 3, 2020