Overview 67 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 19 public PoC · 4 EPSS ≥ 0.5
67matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
19public PoC28.4%
4EPSS ≥ 0.56.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
67
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
67
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
19
28.4%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
48
71.6%
split by
peak 8 / year
19975
Not applicable5
Medium5
not blocked5
Working exploit published2
No public exploit3
19984
Not applicable4
Medium4
not blocked4
Working exploit published1
No public exploit3
19995
Not applicable5
Medium5
not blocked5
Working exploit published2
No public exploit3
20002
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20015
Not applicable5
Medium5
not blocked5
Working exploit published1
No public exploit4
20026
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
20036
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
20043
Not applicable3
Medium3
not blocked3
Working exploit published2
No public exploit1
20052
Not applicable2
Medium2
not blocked2
No public exploit2
20068
Not applicable8
Medium8
not blocked8
No public exploit8
20071
Not applicable1
Medium1
not blocked1
No public exploit1
20081
Not applicable1
Medium1
not blocked1
Working exploit published1
20094
Not applicable4
Medium4
not blocked4
Working exploit published2
No public exploit2
20102
Not applicable2
Medium2
not blocked2
No public exploit2
20115
Not applicable5
Medium5
not blocked5
Working exploit published3
No public exploit2
20122
Not applicable2
Medium2
not blocked2
No public exploit2
20130
20144
Not applicable4
Medium4
not blocked4
No public exploit4
20151
Not applicable1
Medium1
not blocked1
No public exploit1
20160
20170
20180
20190
20200
20211
Not applicable1
Medium1
not blocked1
No public exploit1
1997199920012003200520072009201120132015201720192021
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2020-26139 | Medium | 2021-05-11 | Not applicable | No public exploit | An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even though the sender has not yet successfully authenticated to the AP. This might be abused in projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier to exploit other vulnerabilities in connected clients. |
| CVE-2015-5917 | Medium | 2015-10-09 | Not applicable | No public exploit | The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern, as demonstrated by multiple instances of the {..,..,..}/* substring. |
| CVE-2014-7250 | Medium | 2014-12-12 | Not applicable | No public exploit | The TCP stack in 4.3BSD Net/2, as used in FreeBSD 5.4, NetBSD possibly 2.0, and OpenBSD possibly 3.6, does not properly implement the session timer, which allows remote attackers to cause a denial of service (resource consumption) via crafted packets. |
| CVE-2014-5384 | Medium | 2014-08-21 | Not applicable | No public exploit | The VIQR module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (out-of-bounds array access) via a crafted argument to the iconv_open function. NOTE: this issue was SPLIT from CVE-2014-3951 per ADT2 due to different vulnerability types. |
| CVE-2014-3951 | Medium | 2014-08-21 | Not applicable | No public exploit | The HZ module in the iconv implementation in FreeBSD 10.0 before p6 and NetBSD allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted argument to the iconv_open function. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2014-5384 is used for the NULL pointer dereference. |
| CVE-2014-5015 | Medium | 2014-07-24 | Not applicable | No public exploit | bozotic HTTP server (aka bozohttpd) before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path. |
| CVE-2007-6754 | Medium | 2012-07-25 | Not applicable | No public exploit | The ipalloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD does not properly allocate memory, which makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, related to "integer rounding and overflow" errors. |
| CVE-2006-7252 | Medium | 2012-07-25 | Not applicable | No public exploit | Integer overflow in the calloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which triggers a memory allocation of one byte. |
| CVE-2011-0418 | Medium | 2011-05-24 | Not applicable | Working exploit published | The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command. |
| CVE-2011-0419 | Medium | 2011-05-16 | Not applicable | Working exploit published | Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd. |
| CVE-2011-1547 | Medium | 2011-05-09 | Not applicable | Working exploit published | Multiple stack consumption vulnerabilities in the kernel in NetBSD 4.0, 5.0 before 5.0.3, and 5.1 before 5.1.1, when IPsec is enabled, allow remote attackers to cause a denial of service (memory corruption and panic) or possibly have unspecified other impact via a crafted (1) IPv4 or (2) IPv6 packet with nested IPComp headers. |
| CVE-2010-4755 | Medium | 2011-03-02 | Not applicable | No public exploit | The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632. |
| CVE-2010-4754 | Medium | 2011-03-02 | Not applicable | No public exploit | The glob implementation in libc in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, and OpenBSD 4.7, and Libsystem in Apple Mac OS X before 10.6.8, allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632. |
| CVE-2010-2530 | Medium | 2010-09-29 | Not applicable | No public exploit | Multiple integer signedness errors in smb_subr.c in the netsmb module in the kernel in NetBSD 5.0.2 and earlier, FreeBSD, and Apple Mac OS X allow local users to cause a denial of service (panic) via a negative size value in a /dev/nsmb ioctl operation, as demonstrated by a (1) SMBIOC_LOOKUP or (2) SMBIOC_OPENSESSION ioctl call. |
| CVE-2010-0561 | Medium | 2010-02-08 | Not applicable | No public exploit | Integer signedness error in NetBSD 4.0, 5.0, and NetBSD-current before 2010-01-21 allows local users to cause a denial of service (kernel panic) via a negative mixer index number being passed to (1) the azalia_query_devinfo function in the azalia audio driver (src/sys/dev/pci/azalia.c) or (2) the hdaudio_afg_query_devinfo function in the hdaudio audio driver (src/sys/dev/pci/hdaudio/hdaudio_afg.c). |
| CVE-2009-2793 | Medium | 2009-09-18 | Not applicable | Working exploit published | The kernel in NetBSD, probably 5.0.1 and earlier, on x86 platforms does not properly handle a pre-commit failure of the iret instruction, which might allow local users to gain privileges via vectors related to a tempEIP pseudocode variable that is outside of the code-segment limits. |
| CVE-2009-2483 | Medium | 2009-07-16 | Not applicable | No public exploit | libprop/prop_object.c in proplib in NetBSD 4.0 and 4.0.1 allows local users to cause a denial of service (NULL pointer dereference and kernel panic) via a malformed externalized plist (XML form) containing an undefined element. |
| CVE-2009-2482 | Medium | 2009-07-16 | Not applicable | No public exploit | The pam_unix module in OpenPAM in NetBSD 4.0 before 4.0.2 and 5.0 before 5.0.1 allows local users to change the current root password if it is already known, even when they are not in the wheel group. |
| CVE-2009-0689 | Medium | 2009-07-01 | Not applicable | Working exploit published | Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number. |
| CVE-2008-1215 | Medium | 2008-03-09 | Not applicable | Working exploit published | Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "~" characters. |
| CVE-2007-1677 | Medium | 2007-03-30 | Not applicable | No public exploit | Multiple buffer overflows in the ISO network protocol support in the NetBSD kernel 2.0 through 4.0_BETA2, and NetBSD-current before 20070329, allow local users to execute arbitrary code via long parameters to certain functions, as demonstrated by a long sockaddr structure argument to the clnp_route function. |
| CVE-2006-6730 | Medium | 2006-12-26 | Not applicable | No public exploit | OpenBSD and NetBSD permit usermode code to kill the display server and write to the X.Org /dev/xf86 device, which allows local users with root privileges to reduce securelevel by replacing the System Management Mode (SMM) handler via a write to an SMRAM address within /dev/xf86 (aka the video card memory-mapped I/O range), and then launching the new handler via a System Management Interrupt (SMI), as demonstrated by a write to Programmed I/O port 0xB2. |
| CVE-2006-6654 | Medium | 2006-12-20 | Not applicable | No public exploit | The sendmsg function in NetBSD-current before 20061023, NetBSD 3.0 and 3.0.1 before 20061024, and NetBSD 2.x before 20061029, when run on a 64-bit architecture, allows attackers to cause a denial of service (kernel panic) via an invalid msg_controllen parameter to the sendit function. |
| CVE-2006-6397 | Medium | 2006-12-08 | Not applicable | No public exploit | Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal operations. This issue is not a vulnerability |
| CVE-2006-5218 | Medium | 2006-10-10 | Not applicable | No public exploit | Integer overflow in the systrace_preprepl function (STRIOCREPLACE) in systrace in OpenBSD 3.9 and NetBSD 3 allows local users to cause a denial of service (crash), gain privileges, or read arbitrary kernel memory via large numeric arguments to the systrace ioctl. |
| CVE-2006-3202 | Medium | 2006-06-23 | Not applicable | No public exploit | The ip6_savecontrol function in NetBSD 2.0 through 3.0, under certain configurations, does not check to see if IPv4-mapped sockets are being used before processing IPv6 socket options, which allows local users to cause a denial of service (crash) by creating an IPv4-mapped IPv6 socket with the SO_TIMESTAMP socket option set, then sending an IPv4 packet through the socket. |
| CVE-2006-1797 | Medium | 2006-04-18 | Not applicable | No public exploit | The kernel in NetBSD-current before September 28, 2005 allows local users to cause a denial of service (system crash) by using the SIOCGIFALIAS ioctl to gather information on a non-existent alias of a network interface, which causes a NULL pointer dereference. |
| CVE-2006-1589 | Medium | 2006-04-03 | Not applicable | No public exploit | The elf_load_file function in NetBSD 2.0 through 3.0 allows local users to cause a denial of service (kernel crash) via an ELF interpreter that does not have a PT_LOAD section in its header, which triggers a null dereference. |
| CVE-2006-0145 | Medium | 2006-01-09 | Not applicable | No public exploit | The kernfs_xread function in kernfs in NetBSD 1.6 through 2.1, and OpenBSD 3.8, does not properly validate file offsets against negative 32-bit values that occur as a result of truncation, which allows local users to read arbitrary kernel memory and gain privileges via the lseek system call. |
| CVE-2005-4782 | Medium | 2005-12-31 | Not applicable | No public exploit | NetBSD 2.0 before 2.0.4, 2.1 before 2.1.1, and 3, when the kernel is compiled with "options DIAGNOSTIC," allows local users to cause a denial of service (kernel assertion panic) via a negative linger time in the SO_LINGER socket option. |
| CVE-2005-4733 | Medium | 2005-12-31 | Not applicable | No public exploit | NetBSD 2.0 before 20050316 and NetBSD-current before 20050112 allow local users to cause a denial of service (infinite loop and system hang) by calling the F_CLOSEM fcntl with a parameter value of 0. |
| CVE-2004-0257 | Medium | 2004-11-23 | Not applicable | No public exploit | OpenBSD 3.4 and NetBSD 1.6 and 1.6.1 allow remote attackers to cause a denial of service (crash) by sending an IPv6 packet with a small MTU to a listening port and then issuing a TCP connect to that port. |
| CVE-2004-0230 | Medium | 2004-08-18 | Not applicable | Working exploit published | TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. |
| CVE-2004-0114 | Medium | 2004-03-03 | Not applicable | Working exploit published | The shmat system call in the System V Shared Memory interface for FreeBSD 5.2 and earlier, NetBSD 1.3 and earlier, and OpenBSD 2.6 and earlier, does not properly decrement a shared memory segment's reference count when the vm_map_find function fails, which could allow local users to gain read or write access to a portion of kernel memory and gain privileges. |
| CVE-2003-0914 | Medium | 2003-12-15 | Not applicable | No public exploit | ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL (time-to-live) value. |
| CVE-2003-0653 | Medium | 2003-08-27 | Not applicable | No public exploit | The OSI networking kernel (sys/netiso) in NetBSD 1.6.1 and earlier does not use a BSD-required "PKTHDR" mbuf when sending certain error responses to the sender of an OSI packet, which allows remote attackers to cause a denial of service (kernel panic or crash) via certain OSI packets. |
| CVE-2002-1476 | Medium | 2003-04-22 | Not applicable | No public exploit | Buffer overflow in setlocale in libc on NetBSD 1.4.x through 1.6, and possibly other operating systems, when called with the LC_ALL category, allows local attackers to execute arbitrary code via a user-controlled locale string that has more than 6 elements, which exceeds the boundaries of the new_categories category array, as exploitable through programs such as xterm and zsh. |
| CVE-2002-1543 | Medium | 2003-03-31 | Not applicable | No public exploit | Buffer overflow in trek on NetBSD 1.5 through 1.5.3 allows local users to gain privileges via long keyboard input. |
| CVE-2003-0102 | Medium | 2003-03-18 | Not applicable | Working exploit published | Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize). |
| CVE-2003-0001 | Medium | 2003-01-17 | Not applicable | Working exploit published | Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak. |
| CVE-2002-2245 | Medium | 2002-12-31 | Not applicable | No public exploit | ftpd in NetBSD 1.5 through 1.5.3 and 1.6 does not properly quote a digit in response to a STAT command for a filename that contains a carriage return followed by a digit, which can cause firewalls and other intermediary devices to lose proper track of the FTP session. |
| CVE-2002-1915 | Medium | 2002-12-31 | Not applicable | No public exploit | tip on multiple BSD-based operating systems allows local users to cause a denial of service (execution prevention) by using flock() to lock the /var/log/acculog file. |
| CVE-2002-0666 | Medium | 2002-11-04 | Not applicable | No public exploit | IPSEC implementations including (1) FreeS/WAN and (2) KAME do not properly calculate the length of authentication data, which allows remote attackers to cause a denial of service (kernel panic) via spoofed, short Encapsulating Security Payload (ESP) packets, which result in integer signedness errors. |
| CVE-2002-1192 | Medium | 2002-10-28 | Not applicable | Working exploit published | Multiple buffer overflows in rogue on NetBSD 1.6 and earlier, FreeBSD 4.6, and possibly other operating systems, allows local users to gain "games" group privileges via malformed entries in a game save file. |
| CVE-2002-1165 | Medium | 2002-10-11 | Not applicable | Working exploit published | Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified. |
| CVE-2002-0381 | Medium | 2002-06-25 | Not applicable | No public exploit | The TCP implementation in various BSD operating systems (tcp_input.c) does not properly block connections to broadcast addresses, which could allow remote attackers to bypass intended filters via packets with a unicast link layer address and an IP broadcast address. |
| CVE-2001-0710 | Medium | 2001-09-20 | Not applicable | No public exploit | NetBSD 1.5 and earlier and FreeBSD 4.3 and earlier allows a remote attacker to cause a denial of service by sending a large number of IP fragments to the machine, exhausting the mbuf pool. |
| CVE-2001-1145 | Medium | 2001-08-17 | Not applicable | No public exploit | fts routines in FreeBSD 4.3 and earlier, NetBSD before 1.5.2, and OpenBSD 2.9 and earlier can be forced to change (chdir) into a different directory than intended when the directory above the current directory is moved, which could cause scripts to perform dangerous actions on the wrong directories. |
| CVE-2001-1244 | Medium | 2001-07-07 | Not applicable | Working exploit published | Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum segment size (MSS) to a very small number and requesting large amounts of data, which generates more packets with less TCP-level data that amplify network traffic and consume more server CPU to process. |
| CVE-2000-0315 | Medium | 2001-03-12 | Not applicable | No public exploit | traceroute in NetBSD 1.3.3 and Linux systems allows local unprivileged users to modify the source address of the packets, which could be used in spoofing attacks. |
| CVE-2000-0314 | Medium | 2001-03-12 | Not applicable | No public exploit | traceroute in NetBSD 1.3.3 and Linux systems allows local users to flood other systems by providing traceroute with a large waittime (-w) option, which is not parsed properly and sets the time delay for sending packets to zero. |
| CVE-2000-0440 | Medium | 2000-05-01 | Not applicable | Working exploit published | NetBSD 1.4.2 and earlier allows remote attackers to cause a denial of service by sending a packet with an unaligned IP timestamp option. |
| CVE-2000-0092 | Medium | 2000-01-19 | Not applicable | No public exploit | The BSD make program allows local users to modify files via a symlink attack when the -j option is being used. |
| CVE-1999-1518 | Medium | 1999-07-15 | Not applicable | Working exploit published | Operating systems with shared memory implementations based on BSD 4.4 code allow a user to conduct a denial of service and bypass memory limits (e.g., as specified with rlimits) using mmap or shmget to allocate memory and cause page faults. |
| CVE-1999-0764 | Medium | 1999-05-01 | Not applicable | No public exploit | NetBSD allows ARP packets to overwrite static ARP entries. |
| CVE-1999-0763 | Medium | 1999-05-01 | Not applicable | No public exploit | NetBSD on a multi-homed host allows ARP packets on one network to modify ARP entries on another connected network. |
| CVE-1999-0433 | Medium | 1999-03-21 | Not applicable | Working exploit published | XFree86 startx command is vulnerable to a symlink attack, allowing local users to create files in restricted directories, possibly allowing them to gain privileges or cause a denial of service. |
| CVE-1999-0422 | Medium | 1999-03-17 | Not applicable | No public exploit | In some cases, NetBSD 1.3.3 mount allows local users to execute programs in some file systems that have the "noexec" flag set. |
| CVE-1999-0303 | Medium | 1998-05-21 | Not applicable | No public exploit | Buffer overflow in BNU UUCP daemon (uucpd) through long hostnames. |
| CVE-1999-0011 | Medium | 1998-04-08 | Not applicable | No public exploit | Denial of Service vulnerabilities in BIND 4.9 and BIND 8 Releases via CNAME record and zone transfer. |
| CVE-1999-0010 | Medium | 1998-04-08 | Not applicable | No public exploit | Denial of Service vulnerability in BIND 8 Releases via maliciously formatted DNS messages. |
| CVE-1999-0513 | Medium | 1998-01-05 | Not applicable | Working exploit published | ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service. |
| CVE-1999-0015 | Medium | 1997-12-16 | Not applicable | Working exploit published | Teardrop IP denial of service. |
| CVE-1999-0016 | Medium | 1997-12-01 | Not applicable | Working exploit published | Land IP denial of service. |
| CVE-1999-1225 | Medium | 1997-08-24 | Not applicable | No public exploit | rpc.mountd on Linux, Ultrix, and possibly other operating systems, allows remote attackers to determine the existence of a file on the server by attempting to mount that file, which generates different error messages depending on whether the file exists or not. |
| CVE-1999-0628 | Medium | 1997-07-01 | Not applicable | No public exploit | The rwho/rwhod service is running, which exposes machine status and user information. |
| CVE-1999-0074 | Medium | 1997-07-01 | Not applicable | No public exploit | Listening TCP ports are sequentially allocated, allowing spoofing attacks. |