Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2017-1085

Summary
Assigner-freebsd
Assigner Org ID-63664ac6-956c-4cba-a5d0-f46076e16109
Published At-12 Sep, 2018 | 14:00
Updated At-16 Sep, 2024 | 20:27
Rejected At-
Credits

In FreeBSD before 11.2-RELEASE, an application which calls setrlimit() to increase RLIMIT_STACK may turn a read-only memory region below the stack into a read-write region. A specially crafted executable could be exploited to execute arbitrary code in the user context.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:freebsd
Assigner Org ID:63664ac6-956c-4cba-a5d0-f46076e16109
Published At:12 Sep, 2018 | 14:00
Updated At:16 Sep, 2024 | 20:27
Rejected At:
▼CVE Numbering Authority (CNA)

In FreeBSD before 11.2-RELEASE, an application which calls setrlimit() to increase RLIMIT_STACK may turn a read-only memory region below the stack into a read-write region. A specially crafted executable could be exploited to execute arbitrary code in the user context.

Affected Products
Vendor
FreeBSD FoundationFreeBSD
Product
FreeBSD
Versions
Affected
  • before 11.2-RELEASE
Problem Types
TypeCWE IDDescription
textN/AUserspace stack overflow
Type: text
CWE ID: N/A
Description: Userspace stack overflow
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
x_refsource_MISC
https://www.exploit-db.com/exploits/42279/
exploit
x_refsource_EXPLOIT-DB
Hyperlink: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
Resource:
x_refsource_MISC
Hyperlink: https://www.exploit-db.com/exploits/42279/
Resource:
exploit
x_refsource_EXPLOIT-DB
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
x_refsource_MISC
x_transferred
https://www.exploit-db.com/exploits/42279/
exploit
x_refsource_EXPLOIT-DB
x_transferred
Hyperlink: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://www.exploit-db.com/exploits/42279/
Resource:
exploit
x_refsource_EXPLOIT-DB
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:secteam@freebsd.org
Published At:12 Sep, 2018 | 14:29
Updated At:23 Nov, 2018 | 16:57

In FreeBSD before 11.2-RELEASE, an application which calls setrlimit() to increase RLIMIT_STACK may turn a read-only memory region below the stack into a read-write region. A specially crafted executable could be exploited to execute arbitrary code in the user context.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.07.8HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary2.07.2HIGH
AV:L/AC:L/Au:N/C:C/I:C/A:C
Type: Primary
Version: 3.0
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Type: Primary
Version: 2.0
Base score: 7.2
Base severity: HIGH
Vector:
AV:L/AC:L/Au:N/C:C/I:C/A:C
CPE Matches

FreeBSD Foundation
freebsd
>>freebsd>>Versions before 11.2(exclusive)
cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-119Primarynvd@nist.gov
CWE ID: CWE-119
Type: Primary
Source: nvd@nist.gov
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://www.exploit-db.com/exploits/42279/secteam@freebsd.org
Third Party Advisory
VDB Entry
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txtsecteam@freebsd.org
Exploit
Technical Description
Third Party Advisory
Hyperlink: https://www.exploit-db.com/exploits/42279/
Source: secteam@freebsd.org
Resource:
Third Party Advisory
VDB Entry
Hyperlink: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
Source: secteam@freebsd.org
Resource:
Exploit
Technical Description
Third Party Advisory

Change History

0
Information is not available yet

Similar CVEs

888Records found

CVE-2008-3531
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-6.9||MEDIUM
EPSS-0.32% / 54.29%
||
7 Day CHG~0.00%
Published-05 Sep, 2008 | 16:00
Updated-07 Aug, 2024 | 09:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Stack-based buffer overflow in sys/kern/vfs_mount.c in the kernel in FreeBSD 7.0 and 7.1, when vfs.usermount is enabled, allows local users to gain privileges via a crafted (1) mount or (2) nmount system call, related to copying of "user defined data" in "certain error conditions."

Action-Not Available
Vendor-n/aFreeBSD Foundation
Product-freebsdn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2020-7452
Matching Score-6
Assigner-FreeBSD
ShareView Details
Matching Score-6
Assigner-FreeBSD
CVSS Score-9.1||CRITICAL
EPSS-0.98% / 75.83%
||
7 Day CHG~0.00%
Published-28 Apr, 2020 | 23:36
Updated-04 Aug, 2024 | 09:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In FreeBSD 12.1-STABLE before r357490, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r357489, and 11.3-RELEASE before 11.3-RELEASE-p7, incorrect use of a user-controlled pointer in the epair virtual network module allowed vnet jailed privileged users to panic the host system and potentially execute arbitrary code in the kernel.

Action-Not Available
Vendor-n/aFreeBSD Foundation
Product-freebsdFreeBSD
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2018-17161
Matching Score-6
Assigner-FreeBSD
ShareView Details
Matching Score-6
Assigner-FreeBSD
CVSS Score-9.8||CRITICAL
EPSS-2.25% / 83.93%
||
7 Day CHG~0.00%
Published-03 Jan, 2019 | 17:00
Updated-05 Aug, 2024 | 10:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In FreeBSD before 11.2-STABLE(r348229), 11.2-RELEASE-p7, 12.0-STABLE(r342228), and 12.0-RELEASE-p1, insufficient validation of network-provided data in bootpd may make it possible for a malicious attacker to craft a bootp packet which could cause a stack buffer overflow. It is possible that the buffer overflow could lead to a Denial of Service or remote code execution.

Action-Not Available
Vendor-FreeBSD Foundation
Product-freebsdFreeBSD
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2014-5384
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-5||MEDIUM
EPSS-0.41% / 60.34%
||
7 Day CHG~0.00%
Published-21 Aug, 2014 | 22:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The VIQR module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (out-of-bounds array access) via a crafted argument to the iconv_open function. NOTE: this issue was SPLIT from CVE-2014-3951 per ADT2 due to different vulnerability types.

Action-Not Available
Vendor-n/aNetBSDFreeBSD Foundation
Product-freebsdnetbsdn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2008-2427
Matching Score-6
Assigner-Flexera Software LLC
ShareView Details
Matching Score-6
Assigner-Flexera Software LLC
CVSS Score-9.3||HIGH
EPSS-36.67% / 97.01%
||
7 Day CHG~0.00%
Published-24 Jun, 2008 | 19:00
Updated-07 Aug, 2024 | 08:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Stack-based buffer overflow in NConvert 4.92, GFL SDK 2.82, and XnView 1.93.6 on Windows and 1.70 on Linux and FreeBSD allows user-assisted remote attackers to execute arbitrary code via a crafted format keyword in a Sun TAAC file.

Action-Not Available
Vendor-pagesperso-orangen/aRed Hat, Inc.FreeBSD FoundationMicrosoft Corporation
Product-freebsdgfl_sdkxnviewlinuxnconvertwindows_ntn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2014-3953
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-4.9||MEDIUM
EPSS-0.07% / 22.28%
||
7 Day CHG~0.00%
Published-15 Jul, 2014 | 14:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via a (1) SCTP_SNDRCV, (2) SCTP_EXTRCV, or (3) SCTP_RCVINFO SCTP cmsg or a (4) SCTP_PEER_ADDR_CHANGE, (5) SCTP_REMOTE_ERROR, or (6) SCTP_AUTHENTICATION_EVENT notification.

Action-Not Available
Vendor-n/aFreeBSD Foundation
Product-freebsdn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2014-3000
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-7.8||HIGH
EPSS-8.78% / 92.17%
||
7 Day CHG~0.00%
Published-02 May, 2014 | 14:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 allows remote attackers to cause a denial of service (undefined memory access and system crash) or possibly read system memory via multiple crafted packets, related to moving a reassemble queue entry to the segment list when the queue is full.

Action-Not Available
Vendor-n/aFreeBSD Foundation
Product-freebsdn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2014-3952
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-4.9||MEDIUM
EPSS-0.07% / 21.84%
||
7 Day CHG~0.00%
Published-15 Jul, 2014 | 14:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize the buffer between the header and data of a control message, which allows local users to obtain sensitive information from kernel memory via unspecified vectors.

Action-Not Available
Vendor-n/aFreeBSD Foundation
Product-freebsdn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2014-1452
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-5.8||MEDIUM
EPSS-0.62% / 69.08%
||
7 Day CHG~0.00%
Published-21 Jan, 2014 | 15:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Stack-based buffer overflow in lib/snmpagent.c in bsnmpd, as used in FreeBSD 8.3 through 10.0, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a crafted GETBULK PDU request.

Action-Not Available
Vendor-n/aFreeBSD Foundation
Product-freebsdn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2019-5614
Matching Score-6
Assigner-FreeBSD
ShareView Details
Matching Score-6
Assigner-FreeBSD
CVSS Score-9.8||CRITICAL
EPSS-0.61% / 68.70%
||
7 Day CHG~0.00%
Published-28 Apr, 2020 | 23:41
Updated-04 Aug, 2024 | 20:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE-p8, incomplete packet data validation may result in accessing out-of-bounds memory leading to a kernel panic or other unpredictable results.

Action-Not Available
Vendor-n/aFreeBSD FoundationNetApp, Inc.
Product-freebsdclustered_data_ontapFreeBSD
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE ID-CWE-20
Improper Input Validation
CVE-2014-3954
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-10||HIGH
EPSS-8.93% / 92.25%
||
7 Day CHG~0.00%
Published-27 Oct, 2014 | 15:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Stack-based buffer overflow in rtsold in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted DNS parameters in a router advertisement message.

Action-Not Available
Vendor-n/aFreeBSD Foundation
Product-freebsdn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2017-1084
Matching Score-6
Assigner-FreeBSD
ShareView Details
Matching Score-6
Assigner-FreeBSD
CVSS Score-7.5||HIGH
EPSS-30.19% / 96.52%
||
7 Day CHG~0.00%
Published-12 Sep, 2018 | 14:00
Updated-16 Sep, 2024 | 20:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In FreeBSD before 11.2-RELEASE, multiple issues with the implementation of the stack guard-page reduce the protections afforded by the guard-page. This results in the possibility a poorly written process could be cause a stack overflow.

Action-Not Available
Vendor-FreeBSD Foundation
Product-freebsdFreeBSD
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2011-2895
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-9.3||HIGH
EPSS-6.09% / 90.41%
||
7 Day CHG~0.00%
Published-19 Aug, 2011 | 17:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

Action-Not Available
Vendor-freetypen/aFreeBSD FoundationOpenBSDX.Org FoundationNetBSD
Product-freebsdfreetypelibxfontopenbsdnetbsdn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2017-1083
Matching Score-6
Assigner-FreeBSD
ShareView Details
Matching Score-6
Assigner-FreeBSD
CVSS Score-7.5||HIGH
EPSS-0.39% / 59.26%
||
7 Day CHG~0.00%
Published-12 Sep, 2018 | 14:00
Updated-16 Sep, 2024 | 19:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In FreeBSD before 11.2-RELEASE, a stack guard-page is available but is disabled by default. This results in the possibility a poorly written process could be cause a stack overflow.

Action-Not Available
Vendor-FreeBSD Foundation
Product-freebsdFreeBSD
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2016-6559
Matching Score-6
Assigner-CERT/CC
ShareView Details
Matching Score-6
Assigner-CERT/CC
CVSS Score-9.8||CRITICAL
EPSS-1.05% / 76.62%
||
7 Day CHG~0.00%
Published-13 Jul, 2018 | 20:00
Updated-06 Aug, 2024 | 01:36
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
The BSD libc library's link_ntoa() function may be vulnerable to a classic buffer overflow

Improper bounds checking of the obuf variable in the link_ntoa() function in linkaddr.c of the BSD libc library may allow an attacker to read or write from memory. The full impact and severity depends on the method of exploit and how the library is used by applications. According to analysis by FreeBSD developers, it is very unlikely that applications exist that utilize link_ntoa() in an exploitable manner, and the CERT/CC is not aware of any proof of concept. A blog post describes the functionality of link_ntoa() and points out that none of the base utilities use this function in an exploitable manner. For more information, please see FreeBSD Security Advisory SA-16:37.

Action-Not Available
Vendor-BSDFreeBSD Foundation
Product-freebsdlibc library
CWE ID-CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2016-1885
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-6.2||MEDIUM
EPSS-0.15% / 36.14%
||
7 Day CHG~0.00%
Published-08 Apr, 2016 | 16:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Integer signedness error in the amd64_set_ldt function in sys/amd64/amd64/sys_machdep.c in FreeBSD 9.3 before p39, 10.1 before p31, and 10.2 before p14 allows local users to cause a denial of service (kernel panic) via an i386_set_ldt system call, which triggers a heap-based buffer overflow.

Action-Not Available
Vendor-n/aFreeBSD Foundation
Product-freebsdn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2014-8611
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-6.9||MEDIUM
EPSS-0.11% / 30.41%
||
7 Day CHG~0.00%
Published-18 Sep, 2015 | 10:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The __sflush function in fflush.c in stdio in libc in FreeBSD 10.1 and the kernel in Apple iOS before 9 mishandles failures of the write system call, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted application.

Action-Not Available
Vendor-n/aApple Inc.FreeBSD Foundation
Product-freebsdiphone_osmac_os_xn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2012-0289
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.2||HIGH
EPSS-0.41% / 60.65%
||
7 Day CHG~0.00%
Published-23 May, 2012 | 21:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.710x and Symantec Network Access Control (SNAC) 11.0.600x through 11.0.710x allows local users to gain privileges, and modify data or cause a denial of service, via a crafted script.

Action-Not Available
Vendor-n/aSymantec Corporation
Product-endpoint_protectionnetwork_access_controln/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2011-5174
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.2||HIGH
EPSS-0.05% / 15.69%
||
7 Day CHG~0.00%
Published-15 Sep, 2012 | 17:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) in Intel Q67 Express, C202, C204, C206 Chipsets, and Mobile Intel QM67, and QS67 Chipset before 2nd_gen_i5_i7_SINIT_51.BIN Express; Intel Q57, 3450 Chipsets and Mobile Intel QM57 and QS57 Express Chipset before i5_i7_DUAL_SINIT_51.BIN and i7_QUAD_SINIT_51.BIN; Mobile Intel GM45, GS45, and PM45 Express Chipset before GM45_GS45_PM45_SINIT_51.BIN; Intel Q35 Express Chipsets before Q35_SINIT_51.BIN; and Intel 5520, 5500, X58, and 7500 Chipsets before SINIT ACM 1.1 allows local users to bypass the Trusted Execution Technology protection mechanism and perform other unspecified SINIT ACM functions via unspecified vectors.

Action-Not Available
Vendor-n/aIntel Corporation
Product-7500_chipsetc206_chipsetmobile_intel_gm45_chipset3450_chipsetmobile_intel_qm57_chipsetx58_chipsetmobile_intel_qs67_chipsetmobile_intel_qm67_chipset5520_chipsetq35_express_chipsetmobile_intel_pm45_express_chipset5500_chipsetsinit_authenticated_code_modulec204_chipsetmobile_intel_qs57_express_chipsetc202_chipsetq67_express_chipsetq57_chipsetmobile_intel_qs57_chipsetmobile_intel_gs45_chipsetn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2016-5829
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.8||HIGH
EPSS-0.05% / 16.45%
||
7 Day CHG~0.00%
Published-27 Jun, 2016 | 10:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.

Action-Not Available
Vendor-n/aLinux Kernel Organization, IncDebian GNU/LinuxNovellCanonical Ltd.
Product-suse_linux_enterprise_real_time_extensiondebian_linuxlinux_kernelubuntu_linuxn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2011-4330
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7.2||HIGH
EPSS-0.22% / 44.46%
||
7 Day CHG~0.00%
Published-27 Jan, 2012 | 15:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Stack-based buffer overflow in the hfs_mac2asc function in fs/hfs/trans.c in the Linux kernel 2.6 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via an HFS image with a crafted len field.

Action-Not Available
Vendor-n/aLinux Kernel Organization, Inc
Product-linux_kerneln/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2016-4704
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-7.8||HIGH
EPSS-0.05% / 16.83%
||
7 Day CHG~0.00%
Published-18 Sep, 2016 | 22:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors, a different vulnerability than CVE-2016-4705.

Action-Not Available
Vendor-n/aApple Inc.
Product-xcoden/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2021-36343
Matching Score-4
Assigner-Dell
ShareView Details
Matching Score-4
Assigner-Dell
CVSS Score-7.5||HIGH
EPSS-0.04% / 11.00%
||
7 Day CHG~0.00%
Published-24 Jan, 2022 | 20:10
Updated-16 Sep, 2024 | 16:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

Action-Not Available
Vendor-Dell Inc.
Product-inspiron_15_7570_firmwarelatitude_5401optiplex_7770_all-in-oneinspiron_3470latitude_e7270inspiron_7300_firmwarelatitude_3520precision_3561_firmwareinspiron_5590_firmwarelatitude_12_7280_ultrabook_firmwarelatitude_5179latitude_7380_firmwareinspiron_5570inspiron_7490latitude_14_rugged_5414latitude_e5270alienware_15_r3_firmwarelatitude_9420inspiron_5490_firmwarealienware_area_51m_r1_firmwarelatitude_5590optiplex_5080inspiron_5400_aioinspiron_5502latitude_5511dell_g7_7590_firmwareinspiron_7501inspiron_7300_2-in-1inspiron_7777_aioprecision_5530_2-in-1precision_5550inspiron_7580_firmwarealienware_m15_r1_firmwaredell_g5_5000_firmwarealienware_m17_r3_firmwarelatitude_5300latitude_3380_firmwareoptiplex_7760_aioprecision_5530_firmwareoptiplex_5040latitude_rugged_5420inspiron_13_7370_firmwareoptiplex_5050alienware_aurora_r11latitude_7320latitude_3470inspiron_15_gaming_7577latitude_7300optiplex_3050_aioprecision_3620_towerprecision_3431_toweroptiplex_3060_firmwareinspiron_5490_aio_firmwarelatitude_3420inspiron_3782latitude_3590_firmwarelatitude_7490_firmwarealienware_m15_r2latitude_13_7370_ultrabooklatitude_12_rugged_tablet_7212_firmwareprecision_5520inspiron_7490_firmwareinspiron_5409precision_5720_aiolatitude_7400latitude_5591optiplex_5270_all-in-one_firmwareinspiron_5477_aio_firmwaredell_g3_3579inspiron_3471inspiron_3511_firmwareinspiron_13_7000_firmwarelatitude_3390optiplex_5050_firmwareoptiplex_7071_firmwareinspiron_14_5410latitude_5175_firmwareinspiron_13_7370inspiron_7586optiplex_3040_firmwarelatitude_3400optiplex_5070dell_g15_5510_firmwarelatitude_3420_firmwareinspiron_13_5378_firmwareinspiron_5491_2-in-1_firmwareinspiron_3277_aio_firmwareoptiplex_3090_firmwareoptiplex_3240_all-in-oneinspiron_7506_2-in-1_firmwarelatitude_7320_detachable_firmwarelatitude_9410optiplex_7070latitude_3570dell_g7_7700_firmwareoptiplex_7080_firmwareinspiron_5491_aio_firmwareinspiron_15_5578_firmwarelatitude_5310latitude_rugged_7424_firmwarelatitude_3301inspiron_5594alienware_aurora_r8alienware_x15_r1precision_3450latitude_7480_firmwareinspiron_7777_aio_firmwareoptiplex_7090_uff_firmwarelatitude_e5470_firmwarechengming_3977latitude_3190inspiron_3510_firmwarelatitude_13_7390_2-in-1_firmwarealienware_aurora_r8_firmwareinspiron_5580_firmwareinspiron_3881_firmwarelatitude_rugged_7424latitude_5488latitude_5521latitude_7380optiplex_5480_all-in-one_firmwareprecision_3540alienware_aurora_r11_firmwareinspiron_7510_firmwareinspiron_3580_firmwarelatitude_7520inspiron_3781_firmwareinspiron_15_gaming_7577_firmwareinspiron_3510inspiron_3280_firmwarelatitude_3310latitude_7414_rugged_extreme_firmwarelatitude_5290_2-in-1inspiron_5482precision_7820_toweroptiplex_3090latitude_7290dell_g3_3500_firmwarealienware_area_51m_r1inspiron_5402inspiron_3582inspiron_7700_aiolatitude_7480inspiron_7391_firmwareinspiron_5593latitude_5420_firmwareprecision_3561inspiron_7580inspiron_3668inspiron_5770alienware_m17_r2_firmwarelatitude_3580precision_5820_tower_firmwareinspiron_3668_firmwareinspiron_3493_firmwarelatitude_3190_2-in-1_firmwareinspiron_5480_firmwareinspiron_3590latitude_7210_2-in-1inspiron_3472latitude_3551optiplex_xe3_firmwareinspiron_7590optiplex_7070_firmwareoptiplex_5270_all-in-oneoptiplex_xe3precision_5510latitude_3301_firmwareinspiron_3502latitude_5491latitude_9520_firmwareoptiplex_7040inspiron_7386alienware_aurora_r12latitude_5520_firmwareoptiplex_5480_all-in-oneinspiron_5591_2-in-1_firmwarelatitude_5400latitude_5410precision_3541optiplex_7050_firmwarelatitude_3379_firmwarelatitude_5401_firmwarealienware_m17_r3precision_5820_towerinspiron_3477_aio_firmwareinspiron_7380inspiron_7610latitude_7275_2-in-1_firmwaredell_g7_7588dell_g3_3779inspiron_5400_2-in-1dell_g7_7790_firmwareoptiplex_7770_all-in-one_firmwarelatitude_5400_firmwareinspiron_7610_firmwareinspiron_5400_2-in-1_firmwareinspiron_7391alienware_m17_r4optiplex_7460_all_in_one_firmwarelatitude_rugged_7220ex_firmwareprecision_3440optiplex_7470_all-in-oneoptiplex_5250_firmwareinspiron_5680_firmwarealienware_m15_r3_firmwareinspiron_3576inspiron_3671_firmwareinspiron_7500_2-in-1_firmwareprecision_3550_firmwarelatitude_3310_firmwareinspiron_3781inspiron_3576_firmwareinspiron_5300_firmwareinspiron_3472_firmwarelatitude_3570_firmwareoptiplex_3050_firmwareinspiron_7590_firmwareinspiron_7791_firmwaredell_g7_7588_firmwareoptiplex_5090_towerinspiron_15_3567alienware_m15_r2_firmwareprecision_7920_towerdell_g7_7500_firmwareinspiron_5570_firmwarelatitude_7400_2-in-1_firmwareinspiron_3481inspiron_3780_firmwareprecision_3530inspiron_3582_firmwarelatitude_5411_firmwarelatitude_3510_firmwareinspiron_3470_firmwareinspiron_3593inspiron_5370inspiron_15_5518_firmwarelatitude_13_7370_ultrabook_firmwareinspiron_3481_firmwareprecision_5530latitude_7275_2-in-1dell_g15_5511latitude_7310_firmwareoptiplex_7440_aioinspiron_15_5579_firmwareinspiron_7306_2-in-1inspiron_3790_firmwarelatitude_9510optiplex_3280_all-in-oneinspiron_5770_firmwareinspiron_7586_firmwaredell_g7_7590latitude_3180_firmwarealienware_m17_r1_firmwareinspiron_3581_firmwareinspiron_17_7773latitude_9510_firmwareinspiron_5406_2-in-1optiplex_5490_aio_firmwaredell_g5_5090latitude_3490_firmwarelatitude_5300_2-in-1_firmwareoptiplex_7070_uffinspiron_3511inspiron_5410inspiron_13_7373_firmwarelatitude_5280latitude_5179_firmwareoptiplex_7780_all-in-oneinspiron_5490inspiron_15_5578inspiron_3501_firmwarelatitude_5300_firmwareinspiron_3880inspiron_5580latitude_5480_firmwareprecision_3930_rackinspiron_5391inspiron_5598inspiron_3482dell_g3_3579_firmwarelatitude_5320_firmwareoptiplex_3080alienware_m17_r1latitude_3480precision_3240_cff_firmwareinspiron_3782_firmwareprecision_5750alienware_m15_r4latitude_rugged_5424_firmwareoptiplex_7460_all_in_oneinspiron_13_7373inspiron_7591inspiron_5477_aiolatitude_7310inspiron_14_5410_firmwareinspiron_7790latitude_5421_firmwareinspiron_7500inspiron_7790_firmwarealienware_13_r3latitude_3379optiplex_7480_all-in-onechengming_3990_firmwareprecision_3520_firmwareinspiron_5594_firmwarechengming_3980inspiron_7700_aio_firmwareoptiplex_7060latitude_5290_firmwareinspiron_13_5379_firmwareoptiplex_7480_all-in-one_firmwareoptiplex_3240_all-in-one_firmwarelatitude_7390latitude_3390_firmwareinspiron_3462_firmwarealienware_aurora_r12_firmwarelatitude_3520_firmwareinspiron_5490_aiolatitude_5285_2-in-1_firmwarechengming_3991_firmwareprecision_3510_firmwareinspiron_7400inspiron_7500_2-in-1dell_g5_5590_firmwareoptiplex_7470_all-in-one_firmwarelatitude_e7470precision_3630_tower_firmwareoptiplex_5040_firmwareinspiron_3581inspiron_13_7378inspiron_15_5566_firmwarelatitude_5488_firmwarealienware_17_r5_firmwareinspiron_3480_aio_firmwareoptiplex_7090_uffinspiron_5583inspiron_7500_firmwareprecision_3541_firmwareinspiron_5591_2-in-1alienware_m15_r1inspiron_15_7572inspiron_7506_2-in-1dell_g7_7587_firmwareinspiron_3476_firmwareinspiron_3480_aioinspiron_5680latitude_7200_2-in-1latitude_5511_firmwareinspiron_15_7573_firmwareoptiplex_7040_firmwareinspiron_5493precision_3550inspiron_3891_firmwarelatitude_7420_firmwareoptiplex_5070_firmwareinspiron_5501alienware_15_r4inspiron_5390_firmwarelatitude_3310_2-in-1optiplex_5090_tower_firmwaredell_g7_7500dell_g3_3590_firmwarelatitude_5490alienware_m17_r2inspiron_7390_firmwareprecision_5720_aio_firmwarelatitude_3190_2-in-1optiplex_7071inspiron_3277_aioinspiron_3891inspiron_7786latitude_9410_firmwarelatitude_5310_2_in_1_firmwarelatitude_12_5289_2-in-1_firmwarelatitude_e7270_firmwarelatitude_5280_firmwarelatitude_3180inspiron_7300_2-in-1_firmwareinspiron_7706_2-in-1_firmwaredell_g7_7790inspiron_3268latitude_12_rugged_extreme_7214_firmwarelatitude_5300_2-in-1latitude_e5470optiplex_3070_firmwarelatitude_7410_firmwarelatitude_12_rugged_tablet_7212latitude_e7470_firmwareoptiplex_5260_all-in-onedell_g3_3500inspiron_3476optiplex_7090_tower_firmwareinspiron_5491_aioinspiron_13_5378inspiron_3780inspiron_7380_firmwareinspiron_3462latitude_7390_firmwaredell_g3_3590latitude_5500_firmwarelatitude_5410_firmwarelatitude_3400_firmwarelatitude_3510precision_3560_firmwareinspiron_3502_firmwareinspiron_5584precision_3520inspiron_17_7773_firmwarelatitude_e5570latitude_13_7389_2-in-1_firmwareinspiron_3880_firmwareinspiron_5310_firmwareinspiron_5501_firmwareoptiplex_3050precision_7820_tower_firmwareoptiplex_5080_firmwareinspiron_15_7570latitude_e5270_firmwareinspiron_5493_firmwarelatitude_rugged_5420_firmwareinspiron_3480_firmwarealienware_m15_r3optiplex_5060_firmwareinspiron_13_7000latitude_3470_firmwarealienware_m17_r4_firmwarealienware_x17_r1inspiron_3790latitude_rugged_5424inspiron_15_5566latitude_3190_firmwareinspiron_5494dell_g3_3779_firmwarelatitude_5500inspiron_15_5582inspiron_5508_firmwarelatitude_3500_firmwaredell_g15_5511_firmwarechengming_3991latitude_5288_firmwareinspiron_5400_aio_firmwareinspiron_5480inspiron_7501_firmwareoptiplex_7760_aio_firmwarelatitude_5290_2-in-1_firmwareinspiron_3471_firmwareinspiron_7791latitude_5501latitude_7400_firmwarelatitude_3590precision_3450_firmwareinspiron_7472_firmwarechengming_3990inspiron_5301optiplex_7090_towerlatitude_5491_firmwareinspiron_3493precision_5750_firmwareoptiplex_3060optiplex_5060latitude_5285_2-in-1chengming_3988_firmwareinspiron_5482_firmwarelatitude_3410_firmwarelatitude_5520inspiron_7510inspiron_7400_firmwareoptiplex_7490_aio_firmwareprecision_3530_firmwarelatitude_3320inspiron_5583_firmwarelatitude_5580_firmwarelatitude_3189precision_3240_cffinspiron_7472latitude_5175inspiron_14_3467_firmwareembedded_box_pc_5000latitude_3320_firmwareinspiron_3580inspiron_7386_firmwareoptiplex_7080alienware_aurora_r9inspiron_15_5518alienware_area_51m_r2_firmwarelatitude_13_7390_2-in-1alienware_m15_r4_firmwarelatitude_5480alienware_15_r3inspiron_5310latitude_14_rugged_5414_firmwareoptiplex_3046latitude_13_7389_2-in-1inspiron_15_5582_firmwarealienware_x15_r1_firmwarelatitude_7300_firmwarelatitude_5421latitude_9420_firmwarelatitude_5510inspiron_5401_aio_firmwareinspiron_3593_firmwareoptiplex_7780_all-in-one_firmwareinspiron_5481inspiron_5494_firmwareprecision_3440_firmwareprecision_5530_2-in-1_firmwarealienware_x17_r1_firmwareinspiron_7786_firmwareprecision_3640_firmwarelatitude_3310_2-in-1_firmwareinspiron_15_5579latitude_5320inspiron_3477_aiolatitude_5310_2_in_1latitude_7410inspiron_3590_firmwarelatitude_5501_firmwareoptiplex_3280_all-in-one_firmwarelatitude_5411latitude_12_rugged_extreme_7214optiplex_7450_firmwareinspiron_7306_2-in-1_firmwareoptiplex_7450optiplex_3050_aio_firmwaredell_g5_5090_firmwaredell_g7_7587inspiron_15_3567_firmwareinspiron_5509latitude_3480_firmwarelatitude_3189_firmwarelatitude_7320_detachablelatitude_9520alienware_17_r5inspiron_15_3573_firmwareinspiron_5406_2-in-1_firmwareinspiron_5498optiplex_7440_aio_firmwarelatitude_7420inspiron_7591_firmwarelatitude_5290inspiron_5300inspiron_7706_2-in-1inspiron_5508precision_5550_firmwarechengming_3980_firmwareinspiron_5491_2-in-1latitude_3120_firmwarelatitude_5590_firmwareinspiron_15_7572_firmwareinspiron_5590inspiron_5301_firmwareinspiron_14_3467inspiron_3671inspiron_5408_firmwareinspiron_5498_firmwareprecision_5540alienware_17_r4inspiron_15_3573inspiron_14_3473inspiron_3480latitude_7520_firmwarelatitude_3490precision_3930_rack_firmwaredell_g5_5590inspiron_3670latitude_5420inspiron_7300inspiron_3793_firmwareinspiron_5402_firmwareinspiron_7390latitude_12_7280_ultrabookprecision_3430_tower_firmwarelatitude_3300_firmwarealienware_15_r4_firmwarelatitude_7400_2-in-1inspiron_3490latitude_7210_2-in-1_firmwarelatitude_5510_firmwareinspiron_3670_firmwareoptiplex_7490_aioinspiron_5410_firmwarelatitude_e5570_firmwareinspiron_5408precision_3540_firmwareoptiplex_3046_firmwareinspiron_3482_firmwarelatitude_12_7285_firmwarelatitude_3380dell_g5_5500precision_3431_tower_firmwaredell_g7_7700optiplex_3080_firmwarelatitude_3410precision_5510_firmwarelatitude_rugged_7220precision_3420_towerinspiron_3881latitude_7414_rugged_extremeprecision_3420_tower_firmwarealienware_area_51m_r2dell_g5_5000latitude_5490_firmwarelatitude_5591_firmwareinspiron_3501alienware_13_r3_firmwarelatitude_3500latitude_5310_firmwareinspiron_3793precision_3430_towerinspiron_5481_firmwareprecision_5520_firmwareoptiplex_5490_aiochengming_3988latitude_3300latitude_5580precision_3620_tower_firmwareinspiron_5584_firmwareprecision_5540_firmwareinspiron_5401_firmwaredell_g5_5500_firmwareinspiron_3268_firmwarelatitude_7320_firmwarelatitude_12_7285latitude_3120latitude_12_5289_2-in-1latitude_rugged_7220_firmwareprecision_3560inspiron_5401_aioprecision_3640alienware_17_r4_firmwareoptiplex_5260_all-in-one_firmwarelatitude_rugged_7220exinspiron_5509_firmwareinspiron_5593_firmwarelatitude_7200_2-in-1_firmwareprecision_3630_towerlatitude_3580_firmwareinspiron_5598_firmwarealienware_aurora_r9_firmwareoptiplex_3070inspiron_13_7378_firmwareinspiron_3280optiplex_3040latitude_7290_firmwareinspiron_5370_firmwarelatitude_3551_firmwarechengming_3977_firmwareinspiron_5391_firmwareinspiron_5502_firmwareembedded_box_pc_5000_firmwareinspiron_15_7573optiplex_7050inspiron_3490_firmwareinspiron_5409_firmwareprecision_3510inspiron_13_5379inspiron_5390latitude_5288latitude_7490optiplex_7060_firmwareoptiplex_7070_uff_firmwarelatitude_5521_firmwareinspiron_5401inspiron_14_3473_firmwareoptiplex_5250precision_7920_tower_firmwaredell_g15_5510CPG BIOS
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE ID-CWE-20
Improper Input Validation
CVE-2011-3330
Matching Score-4
Assigner-CERT/CC
ShareView Details
Matching Score-4
Assigner-CERT/CC
CVSS Score-7.2||HIGH
EPSS-1.13% / 77.45%
||
7 Day CHG~0.00%
Published-04 Nov, 2011 | 21:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in the UnitelWay Windows Device Driver, as used in Schneider Electric Unity Pro 6 and earlier, OPC Factory Server 3.34, Vijeo Citect 7.20 and earlier, Telemecanique Driver Pack 2.6 and earlier, Monitor Pro 7.6 and earlier, and PL7 Pro 4.5 and earlier, allows local users, and possibly remote attackers, to execute arbitrary code via an unspecified system parameter.

Action-Not Available
Vendor-n/aSchneider Electric SE
Product-telemecanique_driver_packunity_promonitor_propl7_provijeo_citectopc_factory_servern/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2016-4674
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-7.8||HIGH
EPSS-0.07% / 21.07%
||
7 Day CHG~0.00%
Published-20 Feb, 2017 | 08:35
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "ATS" component. It allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2021-3489
Matching Score-4
Assigner-Canonical Ltd.
ShareView Details
Matching Score-4
Assigner-Canonical Ltd.
CVSS Score-7.8||HIGH
EPSS-0.10% / 27.76%
||
7 Day CHG~0.00%
Published-04 Jun, 2021 | 01:40
Updated-16 Sep, 2024 | 20:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Linux kernel eBPF RINGBUF map oversized allocation

The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).

Action-Not Available
Vendor-Linux Kernel Organization, IncCanonical Ltd.
Product-ubuntu_linuxlinux_kernelLinux kernel
CWE ID-CWE-787
Out-of-bounds Write
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2021-33627
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.2||HIGH
EPSS-0.15% / 36.86%
||
7 Day CHG+0.01%
Published-03 Feb, 2022 | 01:30
Updated-03 Aug, 2024 | 23:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.09.11, 5.1 before 05.17.11, 5.2 before 05.27.11, 5.3 before 05.36.11, 5.4 before 05.44.11, and 5.5 before 05.52.11 affecting FwBlockServiceSmm. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.

Action-Not Available
Vendor-n/aInsyde Software Corp. (ISC)Siemens AG
Product-simatic_ipc127e_firmwaresimatic_ipc477e_firmwaresimatic_ipc427e_firmwaresimatic_ipc847esimatic_ipc377gsimatic_ipc427esimatic_field_pg_m6insydeh2osimatic_ipc227gsimatic_ipc677esimatic_field_pg_m5_firmwaresimatic_ipc677e_firmwaresimatic_ipc277g_firmwaresimatic_ipc227g_firmwaresimatic_ipc127esimatic_ipc647e_firmwaresimatic_ipc277gsimatic_itp1000_firmwaresimatic_ipc627e_firmwaresimatic_ipc477esimatic_field_pg_m6_firmwaresimatic_ipc627esimatic_ipc847e_firmwaresimatic_ipc647esimatic_field_pg_m5simatic_itp1000simatic_ipc327gsimatic_ipc377g_firmwaresimatic_ipc327g_firmwaren/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2011-2517
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7.2||HIGH
EPSS-0.11% / 30.88%
||
7 Day CHG~0.00%
Published-24 May, 2012 | 23:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value.

Action-Not Available
Vendor-n/aRed Hat, Inc.Linux Kernel Organization, Inc
Product-enterprise_linux_desktopenterprise_linux_workstationlinux_kernelenterprise_linuxenterprise_linux_servern/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2021-31979
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-7.8||HIGH
EPSS-0.96% / 75.51%
||
7 Day CHG~0.00%
Published-14 Jul, 2021 | 17:53
Updated-30 Jul, 2025 | 01:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Known KEV||Action Due Date - 2021-11-17||Apply updates per vendor instructions.
Windows Kernel Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

Action-Not Available
Vendor-Microsoft Corporation
Product-windows_server_2016windows_10_1909windows_server_2008windows_10_2004windows_server_2012windows_10_1607windows_10windows_server_2019windows_server_2004windows_8.1windows_7windows_10_1507windows_10_1809windows_10_21h1windows_10_20h2windows_server_20h2windows_rt_8.1Windows 10 Version 1809Windows 10 Version 1507Windows 10 Version 1607Windows 10 Version 20H2Windows Server 2019Windows 10 Version 1909Windows Server 2008 Service Pack 2Windows Server 2008 Service Pack 2Windows Server version 20H2Windows Server 2016Windows Server 2008 R2 Service Pack 1 (Server Core installation)Windows Server 2012 R2 (Server Core installation)Windows Server 2012 (Server Core installation)Windows Server 2019 (Server Core installation)Windows Server 2016 (Server Core installation)Windows 7 Service Pack 1Windows 7Windows 10 Version 2004Windows 10 Version 21H1Windows Server version 2004Windows Server 2012Windows Server 2008 R2 Service Pack 1Windows Server 2012 R2Windows 8.1Windows Server 2008 Service Pack 2 (Server Core installation)Windows
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2018-7522
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
ShareView Details
Matching Score-4
Assigner-Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
CVSS Score-6.7||MEDIUM
EPSS-0.07% / 21.06%
||
7 Day CHG~0.00%
Published-04 May, 2018 | 17:00
Updated-17 Sep, 2024 | 00:02
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, when a system call is made, registers are stored to a fixed memory location. Modifying the data in this location could allow attackers to gain supervisor-level access and control system states.

Action-Not Available
Vendor-
Product-triconex_tricon_mp_3008triconex_tricon_mp_3008_firmwareTriconex Tricon
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2021-30316
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-8.4||HIGH
EPSS-0.03% / 7.80%
||
7 Day CHG~0.00%
Published-20 Oct, 2021 | 06:31
Updated-03 Aug, 2024 | 22:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Possible out of bound memory access due to improper boundary check while creating HSYNC fence in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-fsm10055qca9377_firmwaremdm9150_firmwarewcn3991_firmwaresd678sa6150p_firmwarewsa8830sa8145p_firmwareqcs610fsm10056wcd9360_firmwarecsra6620fsm10055_firmwarewcn3950_firmwaresa8150p_firmwareqca6595au_firmwaresa6155wcd9370csra6620_firmwaresd_675_firmwaresd675_firmwarecsra6640_firmwareqca6584au_firmwarewcn3990_firmwareqca9377sa415mwcn3998wcd9385_firmwarewcn3950sd720gwcn3660bsa8155qca6574au_firmwaresdx55_firmwarewcn3680b_firmwareqca6595ausa6155_firmwaresdx12_firmwarewcd9375_firmwarewcn3998_firmwarewcn3610_firmwarewcd9360qca6564au_firmwareqca6584ausa6155p_firmwaresd778gsa515m_firmwareqcs6490sa8155_firmwaresa415m_firmwareqcs405wcn3988_firmwaresa6145p_firmwaresm6250sd778g_firmwaresa8195pwsa8810_firmwarefsm10056_firmwarewcn6851wcd9335sa6155pqca6174a_firmwarewcd9385wcd9341qca6696_firmwareqcs6490_firmwarewcd9375sa8150psm6250_firmwarewsa8830_firmwaresda429wsd660wcn3620_firmwareqcm6490sd888_5g_firmwarewcn3988sd660_firmwarewcn3620wcn6850_firmwaresa8195p_firmwarewsa8815_firmwarewsa8835_firmwareqcx315qca6564awcn6750_firmwarewcn3610wcn3991sda429w_firmwarewcd9380_firmwarewcn3990sd_675sd780gqca6595qca6564auwcn6856_firmwaresd888wsa8835qca6574qcx315_firmwarewcd9380sd888_5gqcs410qca6574awcn6855_firmwareqca6174asm7325wcd9335_firmwarewcn3980wcn6750sa515mqca6574_firmwarewsa8815wcn6850wcn3660b_firmwareqca6574a_firmwarewcn3980_firmwareqca6391wcn6740_firmwaresd678_firmwarear8031_firmwareqcm6490_firmwaresd480_firmwarewcn6851_firmwareqca6574ausa8155p_firmwareqca6564a_firmwarewcd9341_firmwaresd480wsa8810wcn6855qcs610_firmwaremdm9150wcn6856sa6145pwcn3680bar8031qca6595_firmwareqcs405_firmwaresa8145pwcn6740qca6696qca6391_firmwaresd780g_firmwarewcd9370_firmwaresa6150psd888_firmwaresdx55sa8155pcsra6640sd675sd720g_firmwaresdx12qcs410_firmwaresm7325_firmwareSnapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2011-1223
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.2||HIGH
EPSS-0.05% / 15.41%
||
7 Day CHG~0.00%
Published-17 Jul, 2011 | 20:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in the Alternate Data Stream (aka ADS or named stream) functionality in the backup-archive client in IBM Tivoli Storage Manager (TSM) before 5.4.3.4, 5.5.x before 5.5.3, 6.x before 6.1.4, and 6.2.x before 6.2.2 on Windows allows local users to gain privileges via unspecified vectors.

Action-Not Available
Vendor-n/aIBM CorporationMicrosoft Corporation
Product-windowstivoli_storage_managern/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2019-1768
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-6.7||MEDIUM
EPSS-0.13% / 32.68%
||
7 Day CHG~0.00%
Published-16 May, 2019 | 01:25
Updated-20 Nov, 2024 | 17:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cisco NX-OS Software Buffer Overflow and Command Injection Vulnerability

A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to cause a buffer overflow condition or perform command injection. This could allow the attacker to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument of the affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. An attacker would need valid administrator credentials to exploit these vulnerabilities.

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-nexus_93180lc-exnexus_9332pqnexus_3172tqnexus_93108tc-exnx-osnexus_3636c-rnexus_9508nexus_93120txnexus_93128txnexus_9336pq_aci_spinenexus_3548-xlnexus_31128pqnexus_3132q-vnexus_9332cnexus_9364cnexus_3164qnexus_92348gc-xnexus_3172tq-32tnexus_9336c-fx2nexus_3132c-znexus_3524-xnexus_31108tc-vnexus_9348gc-fxpnexus_3172nexus_9272qnexus_3464cnexus_93216tc-fx2nexus_36180yc-rnexus_93180yc-fxnexus_3264qnexus_3432d-snexus_34180ycnexus_9000vnexus_31108pc-vnexus_3524nexus_3548nexus_3132qnexus_3016nexus_9372pxnexus_92304qcnexus_92160yc-xnexus_9504nexus_3048nexus_9372tx-enexus_93108tc-fxnexus_93360yc-fx2nexus_3524-xlnexus_9396txnexus_92300ycnexus_3064nexus_3232cnexus_9396pxnexus_3264c-enexus_93240yc-fx2nexus_9372txnexus_3548-xnexus_3132q-xlnexus_3064-tnexus_3172tq-xlnexus_93180yc-exnexus_3408-snexus_9372px-enexus_9236cnexus_9516nexus_3172pq-xlCisco NX-OS Software
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2011-1006
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7.2||HIGH
EPSS-0.13% / 33.09%
||
7 Day CHG~0.00%
Published-22 Mar, 2011 | 17:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Heap-based buffer overflow in the parse_cgroup_spec function in tools/tools-common.c in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 allows local users to gain privileges via a crafted controller list on the command line of an application. NOTE: it is not clear whether this issue crosses privilege boundaries.

Action-Not Available
Vendor-balbir_singhn/a
Product-libcgroupn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2021-30289
Matching Score-4
Assigner-Qualcomm, Inc.
ShareView Details
Matching Score-4
Assigner-Qualcomm, Inc.
CVSS Score-7.8||HIGH
EPSS-0.03% / 8.51%
||
7 Day CHG~0.00%
Published-03 Jan, 2022 | 07:26
Updated-03 Aug, 2024 | 22:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Possible buffer overflow due to lack of range check while processing a DIAG command for COEX management in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Action-Not Available
Vendor-Qualcomm Technologies, Inc.
Product-fsm10055qca9377_firmwaremdm9150_firmwarewcn3991_firmwaresd678mdm9640_firmwaresa6150p_firmwaresa8145p_firmwareqcs610sm6250p_firmwareqcs2290_firmwarefsm10056sd7c_firmwarecsrb31024mdm9628_firmwaremdm9650fsm10055_firmwareqcs4290wcn3950_firmwaremdm9250sa8150p_firmwareqca6420_firmwareqca6595au_firmwareqcs2290sd730_firmwarewcd9370qcs605_firmwaresd_675_firmwaresd675_firmwareqca6584au_firmwarewcn3990_firmwareqca9377sa415mwcn3998sdw2500_firmwaresd_8cx_firmwarewcn3950wcd9326_firmwaremdm9628sd720gmdm9206_firmwareqsw8573_firmwarewcn3615_firmwarewcn3660bsd662sd460_firmwareqca6584qca6574au_firmwarewcn3680b_firmwareqca6595ausdx12_firmwarewcd9375_firmwarewcn3615msm8909wwcn3998_firmwareapq8009w_firmwareqca6420wcn3610_firmwaremdm9207qca6564au_firmwareqca6584ausa6155p_firmwareqca9367_firmwarewcd9306mdm8207sm6225sd429qca9367qca4004_firmwaremdm9607_firmwaresd662_firmwaresa415m_firmwarewcn3988_firmwareqca6430sa6145p_firmwaresd205sd429_firmwaresm6250wcd9306_firmwarewcd9340sa8195papq8017_firmwarewsa8810_firmwarequalcomm215_firmwarefsm10056_firmwarewcd9326wcd9335sa6155pqcs603_firmwareqca6174a_firmwaremdm9250_firmwareqcs4290_firmwarewcd9341qca6696_firmwarewcn3910_firmwarewcd9375sd_8cxaqt1000sa8150psm6250_firmwaremdm9207_firmwareqca4004sda429wsd210sd855_firmwaresd660wcn3620_firmwaresdx20_firmwarewcn3988wsa8815_firmwaresd660_firmwarewcn3620sa8195p_firmwareapq8017qca6564awcn3610mdm9640qcm2290_firmwarewcn3991sda429w_firmwarewcd9380_firmwarewcn3990sd_675sdm429wmsm8996au_firmwarewcd9330qca6564ausdx24qet4101_firmwaremsm8909w_firmwareqca6574msm8996ausdm429w_firmwaresd665_firmwarewcd9380sd850sm6250pqualcomm215qcs410qca6574amdm9206qca6174asdx24_firmwareqca6430_firmwarewcd9335_firmwarewcn3980qsw8573mdm9205qca6574_firmwareqcs605wcd9340_firmwaresd855wsa8815sd665sd7cwcn3910qca6584_firmwaremdm9650_firmwarewcn3660b_firmwareqca6574a_firmwaresd850_firmwarewcn3980_firmwaresd460sd730sdxr1_firmwarewcd9330_firmwareaqt1000_firmwaresd678_firmwareqcm4290csrb31024_firmwaresdx20qcs603sm6225_firmwareqca6574ausa8155p_firmwaremdm9607sd205_firmwareqca6564a_firmwareapq8009wwcd9341_firmwareqcm4290_firmwarewsa8810sd210_firmwareqcs610_firmwaremdm9150sa6145pwcn3680bsdxr1apq8096ausa8145pmdm8207_firmwareqca6696mdm9205_firmwaresd845_firmwarewcd9370_firmwaresa6150psdw2500apq8096au_firmwaresa8155psd675sd845qet4101sd720g_firmwaresdx12qcs410_firmwareqcm2290Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2011-1222
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.2||HIGH
EPSS-0.05% / 15.41%
||
7 Day CHG~0.00%
Published-17 Jul, 2011 | 20:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in the Journal Based Backup (JBB) feature in the backup-archive client in IBM Tivoli Storage Manager (TSM) before 5.4.3.4, 5.5.x before 5.5.3, 6.x before 6.1.4, and 6.2.x before 6.2.2 on Windows and AIX allows local users to gain privileges via unspecified vectors.

Action-Not Available
Vendor-n/aIBM CorporationMicrosoft Corporation
Product-aixwindowstivoli_storage_managern/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2016-1721
Matching Score-4
Assigner-Apple Inc.
ShareView Details
Matching Score-4
Assigner-Apple Inc.
CVSS Score-7.8||HIGH
EPSS-0.24% / 47.36%
||
7 Day CHG~0.00%
Published-01 Feb, 2016 | 11:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The kernel in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.

Action-Not Available
Vendor-n/aApple Inc.
Product-mac_os_xiphone_oswatchostvosn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2011-1282
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-8.4||HIGH
EPSS-1.10% / 77.15%
||
7 Day CHG~0.00%
Published-13 Jul, 2011 | 23:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly initialize memory and consequently uses a NULL pointer in an unspecified function call, which allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that triggers an incorrect memory assignment for a user transaction, aka "CSRSS Local EOP SrvSetConsoleLocalEUDC Vulnerability."

Action-Not Available
Vendor-n/aMicrosoft Corporation
Product-windows_7windows_xpwindows_server_2008windows_server_2003windows_2003_serverwindows_vistan/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE ID-CWE-476
NULL Pointer Dereference
CVE-2011-0045
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-7.2||HIGH
EPSS-1.90% / 82.51%
||
7 Day CHG~0.00%
Published-09 Feb, 2011 | 00:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Trace Events functionality in the kernel in Microsoft Windows XP SP3 does not properly perform type conversion, which causes integer truncation and insufficient memory allocation and triggers a buffer overflow, which allows local users to gain privileges via a crafted application, related to WmiTraceMessageVa, aka "Windows Kernel Integer Truncation Vulnerability."

Action-Not Available
Vendor-n/aMicrosoft Corporation
Product-windows_xpn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2011-0521
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7.2||HIGH
EPSS-0.11% / 30.54%
||
7 Day CHG~0.00%
Published-02 Feb, 2011 | 22:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2 does not check the sign of a certain integer field, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a negative value.

Action-Not Available
Vendor-n/aLinux Kernel Organization, Inc
Product-linux_kerneln/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2010-4523
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7.2||HIGH
EPSS-0.26% / 49.33%
||
7 Day CHG~0.00%
Published-07 Jan, 2011 | 19:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple stack-based buffer overflows in libopensc in OpenSC 0.11.13 and earlier allow physically proximate attackers to execute arbitrary code via a long serial-number field on a smart card, related to (1) card-acos5.c, (2) card-atrust-acos.c, and (3) card-starcos.c.

Action-Not Available
Vendor-opensc-projectn/a
Product-openscn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2019-1605
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-7.8||HIGH
EPSS-0.19% / 41.05%
||
7 Day CHG~0.00%
Published-08 Mar, 2019 | 20:00
Updated-20 Nov, 2024 | 17:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cisco NX-OS Software NX-API Arbitrary Code Execution Vulnerability

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary code as root. The vulnerability is due to incorrect input validation in the NX-API feature. An attacker could exploit this vulnerability by sending a crafted HTTP or HTTPS request to an internal service on an affected device that has the NX-API feature enabled. A successful exploit could allow the attacker to cause a buffer overflow and execute arbitrary code as root. Note: The NX-API feature is disabled by default. MDS 9000 Series Multilayer Switches are affected in versions prior to 8.1(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I4(8) and 7.0(3)I7(1). Nexus 3500 Platform Switches are affected in versions prior to 6.0(2)A8(8). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.3(2)N1(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 7.3(3)D1(1). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I4(8) and 7.0(3)I7(1). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-nexus_3500nexus_9000nexus_9500mds_9000nexus_5500nexus_5600nx-osnexus_3000nexus_6000nexus_3600nexus_7000nexus_2000nexus_7700MDS 9000 Series Multilayer SwitchesNexus 3600 Platform SwitchesNexus 9000 Series Switches in Standalone NX-OS ModeNexus 3500 Platform SwitchesNexus 7000 and 7700 Series SwitchesNexus 2000, 5500, 5600, and 6000 Series SwitchesNexus 3000 Series SwitchesNexus 9500 R-Series Line Cards and Fabric Modules
CWE ID-CWE-20
Improper Input Validation
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2009-0779
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.2||HIGH
EPSS-0.06% / 19.75%
||
7 Day CHG~0.00%
Published-04 Mar, 2009 | 11:00
Updated-16 Sep, 2024 | 22:02
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in pppdial in IBM AIX 5.3 and 6.1 allows local users to gain privileges via a long "input string."

Action-Not Available
Vendor-n/aIBM Corporation
Product-aixn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2010-3222
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-7.2||HIGH
EPSS-0.97% / 75.72%
||
7 Day CHG~0.00%
Published-13 Oct, 2010 | 18:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Stack-based buffer overflow in the Remote Procedure Call Subsystem (RPCSS) in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted LPC message that requests an LRPC connection from an LPC server to a client, aka "LPC Message Buffer Overrun Vulnerability."

Action-Not Available
Vendor-n/aMicrosoft Corporation
Product-windows_server_2003windows_xpn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2010-3110
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.2||HIGH
EPSS-0.04% / 12.26%
||
7 Day CHG~0.00%
Published-12 Oct, 2010 | 19:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple buffer overflows in the Novell Client novfs module for the Linux kernel in SUSE Linux Enterprise 11 SP1 and openSUSE 11.3 allow local users to gain privileges via unspecified vectors.

Action-Not Available
Vendor-n/aNovellopenSUSE
Product-suse_linuxopensusen/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2010-3942
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-7.2||HIGH
EPSS-1.57% / 80.83%
||
7 Day CHG~0.00%
Published-16 Dec, 2010 | 19:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly allocate memory for copies from user mode, which allows local users to gain privileges via a crafted application, aka "Win32k WriteAV Vulnerability."

Action-Not Available
Vendor-n/aMicrosoft Corporation
Product-windows_7windows_xpwindows_server_2008windows_server_2003windows_2003_serverwindows_vistan/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2016-10395
Matching Score-4
Assigner-Flexera Software LLC
ShareView Details
Matching Score-4
Assigner-Flexera Software LLC
CVSS Score-7.8||HIGH
EPSS-0.07% / 21.54%
||
7 Day CHG~0.00%
Published-15 Jun, 2017 | 16:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In FlexNet Publisher versions before Luton SP1 (11.14.1.1) running FlexNet Publisher Licensing Service on Windows platform, a boundary error related to a named pipe within the FlexNet Publisher Licensing Service can be exploited to cause an out-of-bounds memory read access and subsequently execute arbitrary code with SYSTEM privileges.

Action-Not Available
Vendor-flexerasoftwareFlexera Software LLC
Product-flexnet_publisherFlexNet Publisher
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2010-3396
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.2||HIGH
EPSS-0.19% / 40.83%
||
7 Day CHG~0.00%
Published-15 Sep, 2010 | 17:26
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in kavfm.sys in Kingsoft Antivirus 2010.04.26.648 and earlier allows local users to execute arbitrary code via a long argument to IOCTL 0x80030004. NOTE: some of these details are obtained from third party information.

Action-Not Available
Vendor-kingsoftn/a
Product-kingsoft_antivirusn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2010-3081
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7.8||HIGH
EPSS-14.75% / 94.24%
||
7 Day CHG~0.00%
Published-24 Sep, 2010 | 19:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.

Action-Not Available
Vendor-n/aVMware (Broadcom Inc.)Linux Kernel Organization, IncSUSE
Product-linux_kernelsuse_linux_enterprise_desktopsuse_linux_enterprise_serveresxn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2010-3084
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7.2||HIGH
EPSS-0.09% / 26.58%
||
7 Day CHG~0.00%
Published-29 Sep, 2010 | 16:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in the niu_get_ethtool_tcam_all function in drivers/net/niu.c in the Linux kernel before 2.6.36-rc4 allows local users to cause a denial of service or possibly have unspecified other impact via the ETHTOOL_GRXCLSRLALL ethtool command.

Action-Not Available
Vendor-n/aLinux Kernel Organization, IncCanonical Ltd.
Product-linux_kernelubuntu_linuxn/a
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
  • Previous
  • 1
  • 2
  • 3
  • 4
  • ...
  • 17
  • 18
  • Next
Details not found