Overview 89 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 17 public PoC · 1 EPSS ≥ 0.5
89matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
17public PoC19.1%
1EPSS ≥ 0.51.1%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
1.1%
Not applicable
88
98.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
89
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
17
19.1%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
72
80.9%
split by
peak 12 / year
19972
Not applicable2
Medium2
not blocked2
No public exploit2
19982
Not applicable2
Medium2
not blocked2
No public exploit2
19995
Not applicable5
Medium5
not blocked5
No public exploit5
20004
Not applicable4
Medium4
not blocked4
Working exploit published1
No public exploit3
20016
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
20029
Not applicable9
Medium9
not blocked9
Working exploit published1
No public exploit8
20034
Not applicable4
Medium4
not blocked4
Working exploit published2
No public exploit2
200412
Not applicable12
Medium12
not blocked12
Working exploit published1
No public exploit11
20055
Outside Waratek scope1
Not applicable4
Medium5
not blocked5
Working exploit published1
No public exploit4
20067
Not applicable7
Medium7
not blocked7
Working exploit published1
No public exploit6
20072
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20083
Not applicable3
Medium3
not blocked3
Working exploit published3
20094
Not applicable4
Medium4
not blocked4
Working exploit published2
No public exploit2
20100
20114
Not applicable4
Medium4
not blocked4
Working exploit published1
No public exploit3
20120
20130
20141
Not applicable1
Medium1
not blocked1
No public exploit1
20150
20160
20179
Not applicable9
Medium9
not blocked9
Working exploit published1
No public exploit8
20181
Not applicable1
Medium1
not blocked1
No public exploit1
20190
20200
20211
Not applicable1
Medium1
not blocked1
No public exploit1
20220
20232
Not applicable2
Medium2
not blocked2
No public exploit2
20244
Not applicable4
Medium4
not blocked4
No public exploit4
20250
20262
Not applicable2
Medium2
not blocked2
No public exploit2
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-56099 | Medium | 2026-06-18 | Not applicable | No public exploit | OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set. |
| CVE-2026-41285 | Medium | 2026-04-21 | Not applicable | No public exploit | In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with no preceding check for whether nd_opt_len is zero. |
| CVE-2024-11149 | Medium | 2024-12-06 | Not applicable | No public exploit | In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs. |
| CVE-2024-10933 | Medium | 2024-12-05 | Not applicable | No public exploit | In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untrusted file systems. |
| CVE-2021-34999 | Medium | 2024-05-07 | Not applicable | No public exploit | OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. . Was ZDI-CAN-14540. |
| CVE-2023-52556 | Medium | 2024-03-01 | Not applicable | No public exploit | In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic. |
| CVE-2023-40216 | Medium | 2023-08-10 | Not applicable | No public exploit | OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences. |
| CVE-2022-48437 | Medium | 2023-04-12 | Not applicable | No public exploit | An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. x509_verify_ctx_add_chain does not store errors that occur during leaf certificate verification, and therefore an incorrect error is returned. This behavior occurs when there is an installed verification callback that instructs the verifier to continue upon detecting an invalid certificate. |
| CVE-2020-26142 | Medium | 2021-05-11 | Not applicable | No public exploit | An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets, independent of the network configuration. |
| CVE-2018-14775 | Medium | 2018-08-01 | Not applicable | No public exploit | tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3 has a Local Denial of Service (system crash) due to incorrect I/O port access control on the i386 architecture. |
| CVE-2017-1000373 | Medium | 2017-06-19 | Not applicable | Working exploit published | The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects OpenBSD 6.1 and possibly earlier versions. |
| CVE-2016-6522 | Medium | 2017-03-07 | Not applicable | No public exploit | Integer overflow in the uvm_map_isavail function in uvm/uvm_map.c in OpenBSD 5.9 allows local users to cause a denial of service (kernel panic) via a crafted mmap call, which triggers the new mapping to overlap with an existing mapping. |
| CVE-2016-6350 | Medium | 2017-03-07 | Not applicable | No public exploit | OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) via a sysctl call with a path starting with 10,9. |
| CVE-2016-6247 | Medium | 2017-03-07 | Not applicable | No public exploit | OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode on the mnt_vnodelist. |
| CVE-2016-6246 | Medium | 2017-03-07 | Not applicable | No public exploit | OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service (kernel panic) by mounting a tmpfs with a VNOVAL in the (1) username, (2) groupname, or (3) device name of the root node. |
| CVE-2016-6245 | Medium | 2017-03-07 | Not applicable | No public exploit | OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a large size in a getdents system call. |
| CVE-2016-6243 | Medium | 2017-03-07 | Not applicable | No public exploit | thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a crafted value in the tsp parameter of the __thrsleep system call. |
| CVE-2016-6242 | Medium | 2017-03-07 | Not applicable | No public exploit | OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (assertion failure and kernel panic) via a large ident value in a kevent system call. |
| CVE-2016-6239 | Medium | 2017-03-07 | Not applicable | No public exploit | The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large size value. |
| CVE-2014-7250 | Medium | 2014-12-12 | Not applicable | No public exploit | The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly implement the session timer, which allows remote attackers to cause a denial of service (resource consumption) via crafted packets. |
| CVE-2011-2168 | Medium | 2011-05-24 | Not applicable | No public exploit | Multiple integer overflows in the glob implementation in libc in OpenBSD before 4.9 might allow context-dependent attackers to have an unspecified impact via a crafted string, related to the GLOB_APPEND and GLOB_DOOFFS flags, a different issue than CVE-2011-0418. |
| CVE-2011-0419 | Medium | 2011-05-16 | Not applicable | Working exploit published | Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd. |
| CVE-2010-4755 | Medium | 2011-03-02 | Not applicable | No public exploit | The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632. |
| CVE-2010-4754 | Medium | 2011-03-02 | Not applicable | No public exploit | The glob implementation in libc in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, and OpenBSD 4.7, and Libsystem in Apple Mac OS X before 10.6.8, allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632. |
| CVE-2009-3572 | Medium | 2009-10-06 | Not applicable | No public exploit | OpenBSD 4.4, 4.5, and 4.6, when running on an i386 kernel, does not properly handle XMM exceptions, which allows local users to cause a denial of service (kernel panic) via unspecified vectors. |
| CVE-2009-0689 | Medium | 2009-07-01 | Not applicable | Working exploit published | Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number. |
| CVE-2009-0537 | Medium | 2009-03-09 | Not applicable | Working exploit published | Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree, related to the fts_level structure member, as demonstrated by (a) du, (b) rm, (c) chmod, and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise. |
| CVE-2009-0780 | Medium | 2009-03-04 | Not applicable | No public exploit | The aspath_prepend function in rde_attr.c in bgpd in OpenBSD 4.3 and 4.4 allows remote attackers to cause a denial of service (application crash) via an Autonomous System (AS) advertisement containing a long AS path. |
| CVE-2008-1215 | Medium | 2008-03-09 | Not applicable | Working exploit published | Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "~" characters. |
| CVE-2007-6700 | Medium | 2008-02-05 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in cgi-bin/bgplg in the web interface for the BGPD daemon in OpenBSD 4.1 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter. |
| CVE-2008-0384 | Medium | 2008-01-22 | Not applicable | Working exploit published | OpenBSD 4.2 allows local users to cause a denial of service (kernel panic) by calling the SIOCGIFRTLABEL IOCTL on an interface that does not have a route label, which triggers a NULL pointer dereference when the return value from the rtlabel_id2name function is not checked. |
| CVE-2007-0343 | Medium | 2007-01-18 | Not applicable | No public exploit | OpenBSD before 20070116 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via certain IPv6 ICMP (aka ICMP6) echo request packets. |
| CVE-2007-0085 | Medium | 2007-01-05 | Not applicable | Working exploit published | Unspecified vulnerability in sys/dev/pci/vga_pci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agp_ioctl NULL pointer reference. |
| CVE-2006-6730 | Medium | 2006-12-26 | Not applicable | No public exploit | OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by replacing the System Management Mode (SMM) handler via a write to an SMRAM address within /dev/xf86 (aka the video card memory-mapped I/O range), and then launching the new handler via a System Management Interrupt (SMI), as demonstrated by a write to Programmed I/O port 0xB2. |
| CVE-2006-6397 | Medium | 2006-12-08 | Not applicable | No public exploit | Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal operations. This issue is not a vulnerability |
| CVE-2006-5550 | Medium | 2006-10-26 | Not applicable | Working exploit published | The kernel in FreeBSD 6.1 and OpenBSD 4.0 allows local users to cause a denial of service via unspecified vectors involving certain ioctl requests to /dev/crypto. |
| CVE-2006-5218 | Medium | 2006-10-10 | Not applicable | No public exploit | Integer overflow in the systrace_preprepl function (STRIOCREPLACE) in systrace in OpenBSD 3.9 and NetBSD 3 allows local users to cause a denial of service (crash), gain privileges, or read arbitrary kernel memory via large numeric arguments to the systrace ioctl. |
| CVE-2006-4436 | Medium | 2006-08-29 | Not applicable | No public exploit | isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations (SA) with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection. |
| CVE-2006-4435 | Medium | 2006-08-29 | Not applicable | No public exploit | OpenBSD 3.8, 3.9, and possibly earlier versions allows context-dependent attackers to cause a denial of service (kernel panic) by allocating more semaphores than the default. |
| CVE-2006-0098 | Medium | 2006-01-06 | Not applicable | No public exploit | The dupfdopen function in sys/kern/kern_descrip.c in OpenBSD 3.7 and 3.8 allows local users to re-open arbitrary files by using setuid programs to access file descriptors using /dev/fd/. |
| CVE-2005-4351 | Medium | 2005-12-31 | Not applicable | No public exploit | The securelevels implementation in FreeBSD 7.0 and earlier, OpenBSD up to 3.8, DragonFly up to 1.2, and Linux up to 2.6.15 allows root users to bypass immutable settings for files by mounting another filesystem that masks the immutable files while the system is running. |
| CVE-2005-0356 | Medium | 2005-05-31 | Outside Waratek scope | Working exploit published | Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old. |
| CVE-2005-0960 | Medium | 2005-05-02 | Not applicable | No public exploit | Multiple vulnerabilities in the SACK functionality in (1) tcp_input.c and (2) tcp_usrreq.c OpenBSD 3.5 and 3.6 allow remote attackers to cause a denial of service (memory exhaustion or system crash). |
| CVE-2005-0637 | Medium | 2005-05-02 | Not applicable | No public exploit | The copy functions in locore.s such as copyout in OpenBSD 3.5 and 3.6, and possibly other BSD based operating systems, may allow attackers to exceed certain address boundaries and modify kernel memory. |
| CVE-2005-0740 | Medium | 2005-01-13 | Not applicable | No public exploit | The TCP stack (tcp_input.c) in OpenBSD 3.5 and 3.6 allows remote attackers to cause a denial of service (system panic) via crafted values in the TCP timestamp option, which causes invalid arguments to be used when calculating the retransmit timeout. |
| CVE-2004-0257 | Medium | 2004-11-23 | Not applicable | No public exploit | OpenBSD 3.4 and NetBSD 1.6 and 1.6.1 allow remote attackers to cause a denial of service (crash) by sending an IPv6 packet with a small MTU to a listening port and then issuing a TCP connect to that port. |
| CVE-2004-0112 | Medium | 2004-11-23 | Not applicable | No public exploit | The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read. |
| CVE-2004-0081 | Medium | 2004-11-23 | Not applicable | No public exploit | OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. |
| CVE-2004-0819 | Medium | 2004-08-25 | Not applicable | No public exploit | The bridge functionality in OpenBSD 3.4 and 3.5, when running a gateway configured as a bridging firewall with the link2 option for IPSec enabled, allows remote attackers to cause a denial of service (crash) via an ICMP echo (ping) packet. |
| CVE-2004-0417 | Medium | 2004-08-06 | Not applicable | No public exploit | Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space. |
| CVE-2004-0482 | Medium | 2004-07-07 | Not applicable | No public exploit | Multiple integer overflows in (1) procfs_cmdline.c, (2) procfs_fpregs.c, (3) procfs_linux.c, (4) procfs_regs.c, (5) procfs_status.c, and (6) procfs_subr.c in procfs for OpenBSD 3.5 and earlier allow local users to read sensitive kernel memory and possibly perform other unauthorized activities. |
| CVE-2004-0222 | Medium | 2004-05-04 | Not applicable | No public exploit | Multiple memory leaks in isakmpd in OpenBSD 3.4 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via certain ISAKMP packets, as demonstrated by the Striker ISAKMP Protocol Test Suite. |
| CVE-2004-0221 | Medium | 2004-05-04 | Not applicable | No public exploit | isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a delete payload containing a large number of SPIs, which triggers an out-of-bounds read error, as demonstrated by the Striker ISAKMP Protocol Test Suite. |
| CVE-2004-0219 | Medium | 2004-05-04 | Not applicable | No public exploit | isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with a malformed IPSEC SA payload, as demonstrated by the Striker ISAKMP Protocol Test Suite. |
| CVE-2004-0218 | Medium | 2004-05-04 | Not applicable | No public exploit | isakmpd in OpenBSD 3.4 and earlier allows remote attackers to cause a denial of service (infinite loop) via an ISAKMP packet with a zero-length payload, as demonstrated by the Striker ISAKMP Protocol Test Suite. |
| CVE-2004-0171 | Medium | 2004-03-15 | Not applicable | No public exploit | FreeBSD 5.1 and earlier, and Mac OS X before 10.3.4, allows remote attackers to cause a denial of service (resource exhaustion of memory buffers and system crash) via a large number of out-of-sequence TCP packets, which prevents the operating system from creating new connections. |
| CVE-2004-0114 | Medium | 2004-03-03 | Not applicable | Working exploit published | The shmat system call in the System V Shared Memory interface for FreeBSD 5.2 and earlier, NetBSD 1.3 and earlier, and OpenBSD 2.6 and earlier, does not properly decrement a shared memory segment's reference count when the vm_map_find function fails, which could allow local users to gain read or write access to a portion of kernel memory and gain privileges. |
| CVE-2003-0955 | Medium | 2003-12-15 | Not applicable | Working exploit published | OpenBSD kernel 3.3 and 3.4 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code in 3.4 via a program with an invalid header that is not properly handled by (1) ibcs2_exec.c in the iBCS2 emulation (compat_ibcs2) or (2) exec_elf.c, which leads to a stack-based buffer overflow. |
| CVE-2003-0804 | Medium | 2003-11-17 | Not applicable | No public exploit | The arplookup function in FreeBSD 5.1 and earlier, Mac OS X before 10.2.8, and possibly other BSD-based systems, allows remote attackers on a local subnet to cause a denial of service (resource starvation and panic) via a flood of spoofed ARP requests. |
| CVE-2003-0688 | Medium | 2003-10-20 | Not applicable | No public exploit | The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data. |
| CVE-2003-0078 | Medium | 2003-03-03 | Not applicable | Working exploit published | ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the "Vaudenay timing attack." |
| CVE-2002-2222 | Medium | 2002-12-31 | Not applicable | No public exploit | isakmpd/message.c in isakmpd in FreeBSD before isakmpd-20020403_1, and in OpenBSD 3.1, allows remote attackers to cause a denial of service (crash) by sending Internet Key Exchange (IKE) payloads out of sequence. |
| CVE-2002-2188 | Medium | 2002-12-31 | Not applicable | No public exploit | OpenBSD before 3.2 allows local users to cause a denial of service (kernel crash) via a call to getrlimit(2) with invalid arguments, possibly due to an integer signedness error. |
| CVE-2002-2180 | Medium | 2002-12-31 | Not applicable | No public exploit | The setitimer(2) system call in OpenBSD 2.0 through 3.1 does not properly check certain arguments, which allows local users to write to kernel memory and possibly gain root privileges, possibly via an integer signedness error. |
| CVE-2002-1915 | Medium | 2002-12-31 | Not applicable | No public exploit | tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file. |
| CVE-2002-1345 | Medium | 2002-12-23 | Not applicable | No public exploit | Directory traversal vulnerabilities in multiple FTP clients on UNIX systems allow remote malicious FTP servers to create or overwrite files as the client user via filenames containing /absolute/path or .. (dot dot) sequences. |
| CVE-2002-1221 | Medium | 2002-11-29 | Not applicable | No public exploit | BIND 8.x through 8.3.3 allows remote attackers to cause a denial of service (crash) via SIG RR elements with invalid expiry times, which are removed from the internal BIND database and later cause a null dereference. |
| CVE-2002-1220 | Medium | 2002-11-29 | Not applicable | Working exploit published | BIND 8.3.x through 8.3.3 allows remote attackers to cause a denial of service (termination due to assertion failure) via a request for a subdomain that does not exist, with an OPT resource record with a large UDP payload size. |
| CVE-2002-0514 | Medium | 2002-08-12 | Not applicable | No public exploit | PF in OpenBSD 3.0 with the return-rst rule sets the TTL to 128 in the RST packet, which allows remote attackers to determine if a port is being filtered because the TTL is different than the default TTL. |
| CVE-2002-0381 | Medium | 2002-06-25 | Not applicable | No public exploit | The TCP implementation in various BSD operating systems (tcp_input.c) does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address. |
| CVE-2001-1559 | Medium | 2001-12-31 | Not applicable | Working exploit published | The uipc system calls (uipc_syscalls.c) in OpenBSD 2.9 and 3.0 provide user mode return instead of versus rval kernel mode values to the fdrelease function, which allows local users to cause a denial of service and trigger a null dereference. |
| CVE-2001-1415 | Medium | 2001-11-13 | Not applicable | No public exploit | vi.recover in OpenBSD before 3.1 allows local users to remove arbitrary zero-byte files such as device nodes. |
| CVE-2001-1145 | Medium | 2001-08-17 | Not applicable | No public exploit | fts routines in FreeBSD 4.3 and earlier, NetBSD before 1.5.2, and OpenBSD 2.9 and earlier can be forced to change (chdir) into a different directory than intended when the directory above the current directory is moved, which could cause scripts to perform dangerous actions on the wrong directories. |
| CVE-2001-1244 | Medium | 2001-07-07 | Not applicable | Working exploit published | Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum segment size (MSS) to a very small number and requesting large amounts of data, which generates more packets with less TCP-level data that amplify network traffic and consume more server CPU to process. |
| CVE-2000-0313 | Medium | 2001-03-12 | Not applicable | No public exploit | Vulnerability in OpenBSD 2.6 allows a local user to change interface media configurations. |
| CVE-2000-0310 | Medium | 2001-03-12 | Not applicable | No public exploit | IP fragment assembly in OpenBSD 2.4 allows a remote attacker to cause a denial of service by sending a large number of fragmented packets. |
| CVE-2000-0962 | Medium | 2000-12-19 | Not applicable | No public exploit | The IPSEC implementation in OpenBSD 2.7 does not properly handle empty AH/ESP packets, which allows remote attackers to cause a denial of service. |
| CVE-2000-0914 | Medium | 2000-12-19 | Not applicable | Working exploit published | OpenBSD 2.6 and earlier allows remote attackers to cause a denial of service by flooding the server with ARP requests. |
| CVE-2000-1004 | Medium | 2000-12-11 | Not applicable | No public exploit | Format string vulnerability in OpenBSD photurisd allows local users to execute arbitrary commands via a configuration file directory name that contains formatting characters. |
| CVE-2000-0092 | Medium | 2000-01-19 | Not applicable | No public exploit | The BSD make program allows local users to modify files via a symlink attack when the -j option is being used. |
| CVE-1999-0001 | Medium | 1999-12-30 | Not applicable | No public exploit | ip_input.c in BSD-derived TCP/IP implementations allows remote attackers to cause a denial of service (crash or hang) via crafted packets. |
| CVE-1999-0724 | Medium | 1999-08-12 | Not applicable | No public exploit | Buffer overflow in OpenBSD procfs and fdescfs file systems via uio_offset in the readdir() function. |
| CVE-1999-0727 | Medium | 1999-08-06 | Not applicable | No public exploit | A kernel leak in the OpenBSD kernel allows IPsec packets to be sent unencrypted. |
| CVE-1999-0481 | Medium | 1999-03-22 | Not applicable | No public exploit | Denial of service in "poll" in OpenBSD. |
| CVE-1999-0482 | Medium | 1999-03-21 | Not applicable | No public exploit | OpenBSD kernel crash through TSS handling, as caused by the crashme program. |
| CVE-1999-0303 | Medium | 1998-05-21 | Not applicable | No public exploit | Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames. |
| CVE-1999-0305 | Medium | 1998-02-01 | Not applicable | No public exploit | The system configuration control (sysctl) facility in BSD based operating systems OpenBSD 2.2 and earlier, and FreeBSD 2.2.5 and earlier, does not properly restrict source routed packets even when the (1) dosourceroute or (2) forwarding variables are set, which allows remote attackers to spoof TCP connections. |
| CVE-1999-0061 | Medium | 1997-10-02 | Not applicable | No public exploit | File creation and deletion, and remote execution, in the BSD line printer daemon (lpd). |
| CVE-1999-1225 | Medium | 1997-08-24 | Not applicable | No public exploit | rpc.mountd on Linux, Ultrix, and possibly other operating systems, allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists or not. |