Leap

CVEs (1,917)

• CVE-2020-4032LowJun 22, 2020
  Freerdp

  Freerdp
  risk 0.13cvss 3.1epss 0.02

  In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /relax-order-checks are affected. This is fixed in version 2.1.2.

• CVE-2014-0195Jun 5, 2014
  OpenSSL Project

  OpenSSL
  risk 0.11cvss —epss 1.00

  The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of…

• CVE-2019-20386LowJan 21, 2020
  Systemd Project

  Systemd
  risk 0.09cvss 2.4epss 0.00

  An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.

• CVE-2014-3470Jun 5, 2014
  OpenSSL Project

  OpenSSL
  risk 0.07cvss —epss 0.86

  The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by…

• CVE-2014-0221Jun 5, 2014
  OpenSSL Project

  OpenSSL
  risk 0.07cvss —epss 0.88

  The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

• CVE-2015-4870Oct 21, 2015
  Fedoraproject

  Fedora
  risk 0.05cvss —epss 0.30

  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser.

• CVE-2017-18017CriJan 3, 2018
  Linux

  Kernel
  risk 0.04cvss 9.8epss 0.53

  The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the…

• CVE-2019-9213MedMar 5, 2019
  Linux

  Kernel
  risk 0.03cvss 5.5epss 0.06

  In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.

• CVE-2020-11945CriApr 23, 2020
  Squid Cache

  Squid
  risk 0.02cvss 9.8epss 0.27

  An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code…

• CVE-2018-1000802CriSep 18, 2018
  Python (programming language)

  Python
  risk 0.02cvss 9.8epss 0.21

  Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via…

• CVE-2015-1283Jul 23, 2015
  Google

  Chrome
  risk 0.02cvss —epss 0.19

  Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via…

• CVE-2020-10543HigJun 5, 2020
  Perl Foundation

  Perl
  risk 0.01cvss 8.2epss 0.11

  Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

• CVE-2020-12640CriMay 4, 2020
  Roundcube

  Webmail
  risk 0.01cvss 9.8epss 0.07

  Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.

• CVE-2020-8492MedJan 30, 2020
  Python (programming language)

  Python
  risk 0.01cvss 6.5epss 0.07

  Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic…

• CVE-2019-19925HigDec 24, 2019
  SQLite

  SQLite
  risk 0.01cvss 7.5epss 0.07

  zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

• CVE-2019-19923HigDec 24, 2019
  SQLite

  SQLite
  risk 0.01cvss 7.5epss 0.07

  flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).

• CVE-2019-19926HigDec 23, 2019
  SQLite

  SQLite
  risk 0.01cvss 7.5epss 0.07

  multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.

• CVE-2019-19880HigDec 18, 2019
  SQLite

  SQLite
  risk 0.01cvss 7.5epss 0.07

  exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

• CVE-2018-16229HigOct 3, 2019
  Tcpdump

  Tcpdump
  risk 0.01cvss 7.5epss 0.07

  The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().

• CVE-2018-16227HigOct 3, 2019
  Tcpdump

  Tcpdump
  risk 0.01cvss 7.5epss 0.07

  The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield.