Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
13 vulnerabilities by nmap
GCVE-1988-2026-0155
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 08:13
VLAI
EPSS
VEX
Title
[NotCVE-2026-0011] Nmap 7.99 and Earlier nselib/packet.lua Zero-Length TCP Option Infinite Loop Allows Remote Denial of Service
Summary
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0011
----------------------------------------------------------------------------
[-] Summary:
Nmap 7.99 and earlier contain a loop with an unreachable exit condition in
the Packet:parse_options() method of nselib/packet.lua. A remote host that
is the target of a scan can exhaust the memory of the scanning Nmap process
and terminate it by replying with a packet that carries a zero-length header
option. No authentication and no access to the scanning machine are
required: the attacker only needs to be scanned.
CVSS:3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
[-] Affected:
Nmap, versions 7.99 and earlier (nselib/packet.lua).
Fixed in commit 7ef4ee0 (2026-06-11). That fix sits above the topmost
release header in the CHANGELOG (Nmap 7.99 [2026-03-26]), so as of this
writing it is present only in the development tree and no released version
carrying it has been verified.
[-] Technical Description:
Packet:parse_options(offset, length) walks the option area with a cursor,
opt_ptr, reading an option type t and, for any type other than 0 (End of
Option List) or 1 (No-Operation), a length byte l taken from
self:u8(offset + opt_ptr + 1). The cursor is then advanced by
opt_ptr = opt_ptr + l.
Before commit 7ef4ee0 the parser accepted l == 0 without validation, so the
cursor never advanced and the "while opt_ptr < length" condition never
became false. Because the loop body allocated a fresh table with
options[op] = {} and incremented op on every pass, the non-terminating loop
also grew a table without bound, and the Lua interpreter embedded in Nmap
consumed memory until the process died. The options[op] = {} assignment was
positioned before the length was validated, which is why the loop allocated
rather than merely spinning.
The method is reached from tcp_parse(), where the option area length derives
from the TCP data offset field of the received packet. A remote peer
therefore controls both the length of the option area and its contents.
nselib/packet.lua is the packet-dissection library used by NSE scripts that
capture and parse raw packets, so exploitation requires the operator to run
a scan that loads such a script against a host the attacker controls.
Nothing is persisted and the effect ends with the process, but the attacker
can repeat it on every subsequent scan, so the host remains effectively
unscannable by any script using this library.
Commit 7ef4ee0 ("Stop parsing on a zero-length packet option") adds an
"if l==0 then break end" guard before any allocation and moves the
options[op] = {} initialisation to after that check. The CHANGELOG entry
reads "[NSE][GH#3368] Fixed an out-of-memory issue in packet.lua when
parsing a zero-length TCP header option."
The step-by-step attack path, the reachability analysis of the IP options
code path and the full write-up are published at the advisory URL below.
Weaknesses:
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC-130: Excessive Allocation
[-] Timeline:
[28/07/2026] - NotCVE ID reserved.
[28/07/2026] - Published as NotCVE-2026-0011.
[-] Credit:
Discovered by Maxim Suhanov (@errno_fail).
[-] Full Details and Updates:
https://notcve.org/notcve/NotCVE-2026-0011
[-] References:
https://github.com/nmap/nmap/issues/3368
https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a
https://github.com/nmap/nmap/pull/3373
https://raw.githubusercontent.com/nmap/nmap/master/nselib/packet.lua
https://raw.githubusercontent.com/nmap/nmap/master/CHANGELOG
[-] About NotCVE:
NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to
vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?
Request a NotCVE: https://notcve.org/form/ · Contributors:
https://notcve.org/hall/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
13 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Nmap",
"vendor": "Nmap",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "advisories"
}
],
"descriptions": [
{
"lang": "en",
"value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0011\n----------------------------------------------------------------------------\n\n[-] Summary:\nNmap 7.99 and earlier contain a loop with an unreachable exit condition in\nthe Packet:parse_options() method of nselib/packet.lua. A remote host that\nis the target of a scan can exhaust the memory of the scanning Nmap process\nand terminate it by replying with a packet that carries a zero-length header\noption. No authentication and no access to the scanning machine are\nrequired: the attacker only needs to be scanned.\nCVSS:3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).\n\n[-] Affected:\nNmap, versions 7.99 and earlier (nselib/packet.lua).\nFixed in commit 7ef4ee0 (2026-06-11). That fix sits above the topmost\nrelease header in the CHANGELOG (Nmap 7.99 [2026-03-26]), so as of this\nwriting it is present only in the development tree and no released version\ncarrying it has been verified.\n\n[-] Technical Description:\nPacket:parse_options(offset, length) walks the option area with a cursor,\nopt_ptr, reading an option type t and, for any type other than 0 (End of\nOption List) or 1 (No-Operation), a length byte l taken from\nself:u8(offset + opt_ptr + 1). The cursor is then advanced by\nopt_ptr = opt_ptr + l.\n\nBefore commit 7ef4ee0 the parser accepted l == 0 without validation, so the\ncursor never advanced and the \"while opt_ptr \u003c length\" condition never\nbecame false. Because the loop body allocated a fresh table with\noptions[op] = {} and incremented op on every pass, the non-terminating loop\nalso grew a table without bound, and the Lua interpreter embedded in Nmap\nconsumed memory until the process died. The options[op] = {} assignment was\npositioned before the length was validated, which is why the loop allocated\nrather than merely spinning.\n\nThe method is reached from tcp_parse(), where the option area length derives\nfrom the TCP data offset field of the received packet. A remote peer\ntherefore controls both the length of the option area and its contents.\nnselib/packet.lua is the packet-dissection library used by NSE scripts that\ncapture and parse raw packets, so exploitation requires the operator to run\na scan that loads such a script against a host the attacker controls.\n\nNothing is persisted and the effect ends with the process, but the attacker\ncan repeat it on every subsequent scan, so the host remains effectively\nunscannable by any script using this library.\n\nCommit 7ef4ee0 (\"Stop parsing on a zero-length packet option\") adds an\n\"if l==0 then break end\" guard before any allocation and moves the\noptions[op] = {} initialisation to after that check. The CHANGELOG entry\nreads \"[NSE][GH#3368] Fixed an out-of-memory issue in packet.lua when\nparsing a zero-length TCP header option.\"\n\nThe step-by-step attack path, the reachability analysis of the IP options\ncode path and the full write-up are published at the advisory URL below.\n\nWeaknesses:\nCWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)\nCWE-400: Uncontrolled Resource Consumption\nCWE-770: Allocation of Resources Without Limits or Throttling\nCAPEC-130: Excessive Allocation\n\n[-] Timeline:\n[28/07/2026] - NotCVE ID reserved.\n[28/07/2026] - Published as NotCVE-2026-0011.\n\n[-] Credit:\nDiscovered by Maxim Suhanov (@errno_fail).\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0011\n\n[-] References:\nhttps://github.com/nmap/nmap/issues/3368\nhttps://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a\nhttps://github.com/nmap/nmap/pull/3373\nhttps://raw.githubusercontent.com/nmap/nmap/master/nselib/packet.lua\nhttps://raw.githubusercontent.com/nmap/nmap/master/CHANGELOG\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-770",
"description": "CWE-770",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-835",
"description": "CWE-835",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T08:13:27Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/112"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/112"
},
{
"url": "https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a"
},
{
"url": "https://github.com/nmap/nmap/issues/3368"
},
{
"url": "https://github.com/nmap/nmap/pull/3373"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://notcve.org"
},
{
"url": "https://notcve.org/form/"
},
{
"url": "https://notcve.org/hall/"
},
{
"url": "https://notcve.org/notcve/NotCVE-2026-0011"
},
{
"url": "https://raw.githubusercontent.com/nmap/nmap/master/CHANGELOG"
},
{
"url": "https://raw.githubusercontent.com/nmap/nmap/master/nselib/packet.lua"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/112"
],
"discovery": "EXTERNAL"
},
"title": "[NotCVE-2026-0011] Nmap 7.99 and Earlier nselib/packet.lua Zero-Length TCP Option Infinite Loop Allows Remote Denial of Service",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0155",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/112",
"automated": true,
"contentSha256": "526e75db3e65ed78ab707f18bcdbc6de452e1ba09cb695995dc1e4c091bc7ef1",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/112",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-19T10:57:53Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:22Z",
"dateUpdated": "2026-09-11T08:13:27Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0155"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58058 (GCVE-0-2026-58058)
Vulnerability from nvd – Published: 2026-06-28 01:32 – Updated: 2026-06-29 14:53
VLAI
EPSS
VEX
Title
Nmap - Integer Underflow in IPv6 Extension Header Parsing
Summary
Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-29 14:49 UTC
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/bikini/exploitarium/tree/main/… | exploitthird-party-advisory |
| https://github.com/nmap/nmap/commit/bb6754e76bb16… | patch |
| https://nmap.org/changelog.html | release-notes |
| https://www.vulncheck.com/advisories/nmap-integer… | third-party-advisory |
Impacted products
Date Public
2026-06-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58058",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-29T14:49:07.833303Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T14:53:48.365Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Nmap",
"vendor": "Nmap",
"versions": [
{
"lessThanOrEqual": "7.99",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nmap:nmap:*:*:*:*:*:*:*:*",
"versionEndIncluding": "7.99",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Himanshu Anand"
}
],
"datePublic": "2026-06-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-28T01:32:59.336Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Proof of Concept",
"tags": [
"exploit",
"third-party-advisory"
],
"url": "https://github.com/bikini/exploitarium/tree/main/nmap-ipv6-extlen-wrap-poc"
},
{
"name": "Fix commit (dev tree)",
"tags": [
"patch"
],
"url": "https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83"
},
{
"name": "Nmap Change Log",
"tags": [
"release-notes"
],
"url": "https://nmap.org/changelog.html"
},
{
"name": "VulnCheck Advisory: Nmap - Integer Underflow in IPv6 Extension Header Parsing",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nmap-integer-underflow-in-ipv6-extension-header-parsing"
}
],
"title": "Nmap - Integer Underflow in IPv6 Extension Header Parsing",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-58058",
"datePublished": "2026-06-28T01:32:59.336Z",
"dateReserved": "2026-06-28T00:58:47.763Z",
"dateUpdated": "2026-06-29T14:53:48.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2017-18594 (GCVE-0-2017-18594)
Vulnerability from nvd – Published: 2019-08-28 23:50 – Updated: 2024-08-05 21:28
VLAI
EPSS
VEX
Summary
nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n character to ssh-brute.nse or ssh-auth-methods.nse.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://seclists.org/nmap-dev/2018/q2/45 | x_refsource_MISC |
| https://github.com/nmap/nmap/issues/1227 | x_refsource_MISC |
| https://github.com/nmap/nmap/commit/350bbe0597d37… | x_refsource_MISC |
| https://github.com/nmap/nmap/issues/1077 | x_refsource_MISC |
| https://github.com/AMatchandaHaystack/Research/bl… | x_refsource_MISC |
| https://seclists.org/nmap-announce/2019/0 | x_refsource_MISC |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:28:55.571Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://seclists.org/nmap-dev/2018/q2/45"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nmap/nmap/issues/1227"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nmap/nmap/commit/350bbe0597d37ad67abe5fef8fba984707b4e9ad"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nmap/nmap/issues/1077"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/AMatchandaHaystack/Research/blob/master/Nmap%26libsshDF"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://seclists.org/nmap-announce/2019/0"
},
{
"name": "openSUSE-SU-2019:2198",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html"
},
{
"name": "openSUSE-SU-2019:2200",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \\n character to ssh-brute.nse or ssh-auth-methods.nse."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-09-26T11:06:10.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://seclists.org/nmap-dev/2018/q2/45"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nmap/nmap/issues/1227"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nmap/nmap/commit/350bbe0597d37ad67abe5fef8fba984707b4e9ad"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nmap/nmap/issues/1077"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/AMatchandaHaystack/Research/blob/master/Nmap%26libsshDF"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://seclists.org/nmap-announce/2019/0"
},
{
"name": "openSUSE-SU-2019:2198",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html"
},
{
"name": "openSUSE-SU-2019:2200",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-18594",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \\n character to ssh-brute.nse or ssh-auth-methods.nse."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://seclists.org/nmap-dev/2018/q2/45",
"refsource": "MISC",
"url": "https://seclists.org/nmap-dev/2018/q2/45"
},
{
"name": "https://github.com/nmap/nmap/issues/1227",
"refsource": "MISC",
"url": "https://github.com/nmap/nmap/issues/1227"
},
{
"name": "https://github.com/nmap/nmap/commit/350bbe0597d37ad67abe5fef8fba984707b4e9ad",
"refsource": "MISC",
"url": "https://github.com/nmap/nmap/commit/350bbe0597d37ad67abe5fef8fba984707b4e9ad"
},
{
"name": "https://github.com/nmap/nmap/issues/1077",
"refsource": "MISC",
"url": "https://github.com/nmap/nmap/issues/1077"
},
{
"name": "https://github.com/AMatchandaHaystack/Research/blob/master/Nmap%26libsshDF",
"refsource": "MISC",
"url": "https://github.com/AMatchandaHaystack/Research/blob/master/Nmap%26libsshDF"
},
{
"name": "https://seclists.org/nmap-announce/2019/0",
"refsource": "MISC",
"url": "https://seclists.org/nmap-announce/2019/0"
},
{
"name": "openSUSE-SU-2019:2198",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html"
},
{
"name": "openSUSE-SU-2019:2200",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-18594",
"datePublished": "2019-08-28T23:50:22.000Z",
"dateReserved": "2019-08-28T00:00:00.000Z",
"dateUpdated": "2024-08-05T21:28:55.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-11490 (GCVE-0-2019-11490)
Vulnerability from nvd – Published: 2019-04-24 02:40 – Updated: 2024-08-04 22:55
VLAI
EPSS
VEX
Summary
An issue was discovered in Npcap 0.992. Sending a malformed .pcap file with the loopback adapter using either pcap_sendqueue_queue() or pcap_sendqueue_transmit() results in kernel pool corruption. This could lead to arbitrary code executing inside the Windows kernel and allow escalation of privileges.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/nmap/nmap/issues/1568 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:55:40.638Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nmap/nmap/issues/1568"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Npcap 0.992. Sending a malformed .pcap file with the loopback adapter using either pcap_sendqueue_queue() or pcap_sendqueue_transmit() results in kernel pool corruption. This could lead to arbitrary code executing inside the Windows kernel and allow escalation of privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-24T02:40:38.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nmap/nmap/issues/1568"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-11490",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Npcap 0.992. Sending a malformed .pcap file with the loopback adapter using either pcap_sendqueue_queue() or pcap_sendqueue_transmit() results in kernel pool corruption. This could lead to arbitrary code executing inside the Windows kernel and allow escalation of privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/nmap/nmap/issues/1568",
"refsource": "MISC",
"url": "https://github.com/nmap/nmap/issues/1568"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-11490",
"datePublished": "2019-04-24T02:40:38.000Z",
"dateReserved": "2019-04-23T00:00:00.000Z",
"dateUpdated": "2024-08-04T22:55:40.638Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-15173 (GCVE-0-2018-15173)
Vulnerability from nvd – Published: 2018-08-08 00:00 – Updated: 2024-08-05 09:46
VLAI
EPSS
VEX
Summary
Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted TCP-based service.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://code610.blogspot.com/2018/07/crashing-nmap… | x_refsource_MISC |
| http://code610.blogspot.com/2018/07/crashing-nmap… | x_refsource_MISC |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| https://security.netapp.com/advisory/ntap-2020082… | x_refsource_CONFIRM |
Date Public
2018-08-07 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T09:46:25.504Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://code610.blogspot.com/2018/07/crashing-nmap-770.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://code610.blogspot.com/2018/07/crashing-nmap-760.html"
},
{
"name": "openSUSE-SU-2019:1462",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00067.html"
},
{
"name": "openSUSE-SU-2019:2198",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html"
},
{
"name": "openSUSE-SU-2019:2200",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20200827-0004/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted TCP-based service."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-27T10:06:21.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://code610.blogspot.com/2018/07/crashing-nmap-770.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://code610.blogspot.com/2018/07/crashing-nmap-760.html"
},
{
"name": "openSUSE-SU-2019:1462",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00067.html"
},
{
"name": "openSUSE-SU-2019:2198",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html"
},
{
"name": "openSUSE-SU-2019:2200",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20200827-0004/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-15173",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted TCP-based service."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://code610.blogspot.com/2018/07/crashing-nmap-770.html",
"refsource": "MISC",
"url": "http://code610.blogspot.com/2018/07/crashing-nmap-770.html"
},
{
"name": "http://code610.blogspot.com/2018/07/crashing-nmap-760.html",
"refsource": "MISC",
"url": "http://code610.blogspot.com/2018/07/crashing-nmap-760.html"
},
{
"name": "openSUSE-SU-2019:1462",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00067.html"
},
{
"name": "openSUSE-SU-2019:2198",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html"
},
{
"name": "openSUSE-SU-2019:2200",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200827-0004/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200827-0004/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-15173",
"datePublished": "2018-08-08T00:00:00.000Z",
"dateReserved": "2018-08-07T00:00:00.000Z",
"dateUpdated": "2024-08-05T09:46:25.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-1000161 (GCVE-0-2018-1000161)
Vulnerability from nvd – Published: 2018-04-18 19:00 – Updated: 2024-08-05 12:33
VLAI
EPSS
VEX
Summary
nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against a malicious web site. This vulnerability appears to have been fixed in 7.7.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://nmap.org/changelog.html | x_refsource_MISC |
Date Public
2018-04-18 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:33:49.471Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nmap.org/changelog.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2018-04-06T00:00:00.000Z",
"datePublic": "2018-04-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against a malicious web site. This vulnerability appears to have been fixed in 7.7."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-18T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nmap.org/changelog.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2018-04-06T14:09:26.583532",
"DATE_REQUESTED": "2018-03-27T14:18:58",
"ID": "CVE-2018-1000161",
"REQUESTER": "ocve@wolke7.net",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against a malicious web site. This vulnerability appears to have been fixed in 7.7."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://nmap.org/changelog.html",
"refsource": "MISC",
"url": "https://nmap.org/changelog.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-1000161",
"datePublished": "2018-04-18T19:00:00.000Z",
"dateReserved": "2018-03-27T00:00:00.000Z",
"dateUpdated": "2024-08-05T12:33:49.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4885 (GCVE-0-2013-4885)
Vulnerability from nvd – Published: 2013-10-26 17:00 – Updated: 2024-08-06 16:59
VLAI
EPSS
VEX
Summary
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://www.trustwave.com/spiderlabs/advisories/T… | x_refsource_MISC |
| http://lists.opensuse.org/opensuse-updates/2013-1… | vendor-advisoryx_refsource_SUSE |
| http://lists.opensuse.org/opensuse-updates/2013-1… | vendor-advisoryx_refsource_SUSE |
| http://packetstormsecurity.com/files/122719/TWSL2… | x_refsource_MISC |
| http://nmap.org/changelog.html | x_refsource_CONFIRM |
| https://github.com/drk1wi/portspoof/commit/1791fe… | x_refsource_MISC |
Date Public
2013-07-29 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:40.513Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2013-025.txt"
},
{
"name": "openSUSE-SU-2013:1561",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00030.html"
},
{
"name": "openSUSE-SU-2013:1579",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00035.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/122719/TWSL2013-025.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://nmap.org/changelog.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/drk1wi/portspoof/commit/1791fe4e2b9e5b5c8e000551ab60a64a29d924c3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-07-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload \"arbitrarily named\" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-12-01T17:26:34.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2013-025.txt"
},
{
"name": "openSUSE-SU-2013:1561",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00030.html"
},
{
"name": "openSUSE-SU-2013:1579",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00035.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/122719/TWSL2013-025.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://nmap.org/changelog.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/drk1wi/portspoof/commit/1791fe4e2b9e5b5c8e000551ab60a64a29d924c3"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4885",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload \"arbitrarily named\" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.trustwave.com/spiderlabs/advisories/TWSL2013-025.txt",
"refsource": "MISC",
"url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2013-025.txt"
},
{
"name": "openSUSE-SU-2013:1561",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00030.html"
},
{
"name": "openSUSE-SU-2013:1579",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00035.html"
},
{
"name": "http://packetstormsecurity.com/files/122719/TWSL2013-025.txt",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/122719/TWSL2013-025.txt"
},
{
"name": "http://nmap.org/changelog.html",
"refsource": "CONFIRM",
"url": "http://nmap.org/changelog.html"
},
{
"name": "https://github.com/drk1wi/portspoof/commit/1791fe4e2b9e5b5c8e000551ab60a64a29d924c3",
"refsource": "MISC",
"url": "https://github.com/drk1wi/portspoof/commit/1791fe4e2b9e5b5c8e000551ab60a64a29d924c3"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4885",
"datePublished": "2013-10-26T17:00:00.000Z",
"dateReserved": "2013-07-22T00:00:00.000Z",
"dateUpdated": "2024-08-06T16:59:40.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-58058 (GCVE-0-2026-58058)
Vulnerability from cvelistv5 – Published: 2026-06-28 01:32 – Updated: 2026-06-29 14:53
VLAI
EPSS
VEX
Title
Nmap - Integer Underflow in IPv6 Extension Header Parsing
Summary
Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-29 14:49 UTC
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/bikini/exploitarium/tree/main/… | exploitthird-party-advisory |
| https://github.com/nmap/nmap/commit/bb6754e76bb16… | patch |
| https://nmap.org/changelog.html | release-notes |
| https://www.vulncheck.com/advisories/nmap-integer… | third-party-advisory |
Impacted products
Date Public
2026-06-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58058",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-29T14:49:07.833303Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T14:53:48.365Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Nmap",
"vendor": "Nmap",
"versions": [
{
"lessThanOrEqual": "7.99",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nmap:nmap:*:*:*:*:*:*:*:*",
"versionEndIncluding": "7.99",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Himanshu Anand"
}
],
"datePublic": "2026-06-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-28T01:32:59.336Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Proof of Concept",
"tags": [
"exploit",
"third-party-advisory"
],
"url": "https://github.com/bikini/exploitarium/tree/main/nmap-ipv6-extlen-wrap-poc"
},
{
"name": "Fix commit (dev tree)",
"tags": [
"patch"
],
"url": "https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83"
},
{
"name": "Nmap Change Log",
"tags": [
"release-notes"
],
"url": "https://nmap.org/changelog.html"
},
{
"name": "VulnCheck Advisory: Nmap - Integer Underflow in IPv6 Extension Header Parsing",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nmap-integer-underflow-in-ipv6-extension-header-parsing"
}
],
"title": "Nmap - Integer Underflow in IPv6 Extension Header Parsing",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-58058",
"datePublished": "2026-06-28T01:32:59.336Z",
"dateReserved": "2026-06-28T00:58:47.763Z",
"dateUpdated": "2026-06-29T14:53:48.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2017-18594 (GCVE-0-2017-18594)
Vulnerability from cvelistv5 – Published: 2019-08-28 23:50 – Updated: 2024-08-05 21:28
VLAI
EPSS
VEX
Summary
nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n character to ssh-brute.nse or ssh-auth-methods.nse.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://seclists.org/nmap-dev/2018/q2/45 | x_refsource_MISC |
| https://github.com/nmap/nmap/issues/1227 | x_refsource_MISC |
| https://github.com/nmap/nmap/commit/350bbe0597d37… | x_refsource_MISC |
| https://github.com/nmap/nmap/issues/1077 | x_refsource_MISC |
| https://github.com/AMatchandaHaystack/Research/bl… | x_refsource_MISC |
| https://seclists.org/nmap-announce/2019/0 | x_refsource_MISC |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:28:55.571Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://seclists.org/nmap-dev/2018/q2/45"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nmap/nmap/issues/1227"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nmap/nmap/commit/350bbe0597d37ad67abe5fef8fba984707b4e9ad"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nmap/nmap/issues/1077"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/AMatchandaHaystack/Research/blob/master/Nmap%26libsshDF"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://seclists.org/nmap-announce/2019/0"
},
{
"name": "openSUSE-SU-2019:2198",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html"
},
{
"name": "openSUSE-SU-2019:2200",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \\n character to ssh-brute.nse or ssh-auth-methods.nse."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-09-26T11:06:10.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://seclists.org/nmap-dev/2018/q2/45"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nmap/nmap/issues/1227"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nmap/nmap/commit/350bbe0597d37ad67abe5fef8fba984707b4e9ad"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nmap/nmap/issues/1077"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/AMatchandaHaystack/Research/blob/master/Nmap%26libsshDF"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://seclists.org/nmap-announce/2019/0"
},
{
"name": "openSUSE-SU-2019:2198",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html"
},
{
"name": "openSUSE-SU-2019:2200",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-18594",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \\n character to ssh-brute.nse or ssh-auth-methods.nse."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://seclists.org/nmap-dev/2018/q2/45",
"refsource": "MISC",
"url": "https://seclists.org/nmap-dev/2018/q2/45"
},
{
"name": "https://github.com/nmap/nmap/issues/1227",
"refsource": "MISC",
"url": "https://github.com/nmap/nmap/issues/1227"
},
{
"name": "https://github.com/nmap/nmap/commit/350bbe0597d37ad67abe5fef8fba984707b4e9ad",
"refsource": "MISC",
"url": "https://github.com/nmap/nmap/commit/350bbe0597d37ad67abe5fef8fba984707b4e9ad"
},
{
"name": "https://github.com/nmap/nmap/issues/1077",
"refsource": "MISC",
"url": "https://github.com/nmap/nmap/issues/1077"
},
{
"name": "https://github.com/AMatchandaHaystack/Research/blob/master/Nmap%26libsshDF",
"refsource": "MISC",
"url": "https://github.com/AMatchandaHaystack/Research/blob/master/Nmap%26libsshDF"
},
{
"name": "https://seclists.org/nmap-announce/2019/0",
"refsource": "MISC",
"url": "https://seclists.org/nmap-announce/2019/0"
},
{
"name": "openSUSE-SU-2019:2198",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html"
},
{
"name": "openSUSE-SU-2019:2200",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-18594",
"datePublished": "2019-08-28T23:50:22.000Z",
"dateReserved": "2019-08-28T00:00:00.000Z",
"dateUpdated": "2024-08-05T21:28:55.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-11490 (GCVE-0-2019-11490)
Vulnerability from cvelistv5 – Published: 2019-04-24 02:40 – Updated: 2024-08-04 22:55
VLAI
EPSS
VEX
Summary
An issue was discovered in Npcap 0.992. Sending a malformed .pcap file with the loopback adapter using either pcap_sendqueue_queue() or pcap_sendqueue_transmit() results in kernel pool corruption. This could lead to arbitrary code executing inside the Windows kernel and allow escalation of privileges.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/nmap/nmap/issues/1568 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:55:40.638Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/nmap/nmap/issues/1568"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Npcap 0.992. Sending a malformed .pcap file with the loopback adapter using either pcap_sendqueue_queue() or pcap_sendqueue_transmit() results in kernel pool corruption. This could lead to arbitrary code executing inside the Windows kernel and allow escalation of privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-24T02:40:38.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/nmap/nmap/issues/1568"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-11490",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Npcap 0.992. Sending a malformed .pcap file with the loopback adapter using either pcap_sendqueue_queue() or pcap_sendqueue_transmit() results in kernel pool corruption. This could lead to arbitrary code executing inside the Windows kernel and allow escalation of privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/nmap/nmap/issues/1568",
"refsource": "MISC",
"url": "https://github.com/nmap/nmap/issues/1568"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-11490",
"datePublished": "2019-04-24T02:40:38.000Z",
"dateReserved": "2019-04-23T00:00:00.000Z",
"dateUpdated": "2024-08-04T22:55:40.638Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-15173 (GCVE-0-2018-15173)
Vulnerability from cvelistv5 – Published: 2018-08-08 00:00 – Updated: 2024-08-05 09:46
VLAI
EPSS
VEX
Summary
Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted TCP-based service.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://code610.blogspot.com/2018/07/crashing-nmap… | x_refsource_MISC |
| http://code610.blogspot.com/2018/07/crashing-nmap… | x_refsource_MISC |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| https://security.netapp.com/advisory/ntap-2020082… | x_refsource_CONFIRM |
Date Public
2018-08-07 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T09:46:25.504Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://code610.blogspot.com/2018/07/crashing-nmap-770.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://code610.blogspot.com/2018/07/crashing-nmap-760.html"
},
{
"name": "openSUSE-SU-2019:1462",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00067.html"
},
{
"name": "openSUSE-SU-2019:2198",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html"
},
{
"name": "openSUSE-SU-2019:2200",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20200827-0004/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted TCP-based service."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-27T10:06:21.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://code610.blogspot.com/2018/07/crashing-nmap-770.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://code610.blogspot.com/2018/07/crashing-nmap-760.html"
},
{
"name": "openSUSE-SU-2019:1462",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00067.html"
},
{
"name": "openSUSE-SU-2019:2198",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html"
},
{
"name": "openSUSE-SU-2019:2200",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20200827-0004/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-15173",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted TCP-based service."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://code610.blogspot.com/2018/07/crashing-nmap-770.html",
"refsource": "MISC",
"url": "http://code610.blogspot.com/2018/07/crashing-nmap-770.html"
},
{
"name": "http://code610.blogspot.com/2018/07/crashing-nmap-760.html",
"refsource": "MISC",
"url": "http://code610.blogspot.com/2018/07/crashing-nmap-760.html"
},
{
"name": "openSUSE-SU-2019:1462",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00067.html"
},
{
"name": "openSUSE-SU-2019:2198",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00073.html"
},
{
"name": "openSUSE-SU-2019:2200",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00075.html"
},
{
"name": "https://security.netapp.com/advisory/ntap-20200827-0004/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20200827-0004/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-15173",
"datePublished": "2018-08-08T00:00:00.000Z",
"dateReserved": "2018-08-07T00:00:00.000Z",
"dateUpdated": "2024-08-05T09:46:25.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-1000161 (GCVE-0-2018-1000161)
Vulnerability from cvelistv5 – Published: 2018-04-18 19:00 – Updated: 2024-08-05 12:33
VLAI
EPSS
VEX
Summary
nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against a malicious web site. This vulnerability appears to have been fixed in 7.7.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://nmap.org/changelog.html | x_refsource_MISC |
Date Public
2018-04-18 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:33:49.471Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nmap.org/changelog.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2018-04-06T00:00:00.000Z",
"datePublic": "2018-04-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against a malicious web site. This vulnerability appears to have been fixed in 7.7."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-18T18:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nmap.org/changelog.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2018-04-06T14:09:26.583532",
"DATE_REQUESTED": "2018-03-27T14:18:58",
"ID": "CVE-2018-1000161",
"REQUESTER": "ocve@wolke7.net",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against a malicious web site. This vulnerability appears to have been fixed in 7.7."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://nmap.org/changelog.html",
"refsource": "MISC",
"url": "https://nmap.org/changelog.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-1000161",
"datePublished": "2018-04-18T19:00:00.000Z",
"dateReserved": "2018-03-27T00:00:00.000Z",
"dateUpdated": "2024-08-05T12:33:49.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4885 (GCVE-0-2013-4885)
Vulnerability from cvelistv5 – Published: 2013-10-26 17:00 – Updated: 2024-08-06 16:59
VLAI
EPSS
VEX
Summary
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://www.trustwave.com/spiderlabs/advisories/T… | x_refsource_MISC |
| http://lists.opensuse.org/opensuse-updates/2013-1… | vendor-advisoryx_refsource_SUSE |
| http://lists.opensuse.org/opensuse-updates/2013-1… | vendor-advisoryx_refsource_SUSE |
| http://packetstormsecurity.com/files/122719/TWSL2… | x_refsource_MISC |
| http://nmap.org/changelog.html | x_refsource_CONFIRM |
| https://github.com/drk1wi/portspoof/commit/1791fe… | x_refsource_MISC |
Date Public
2013-07-29 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:40.513Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2013-025.txt"
},
{
"name": "openSUSE-SU-2013:1561",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00030.html"
},
{
"name": "openSUSE-SU-2013:1579",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00035.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/122719/TWSL2013-025.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://nmap.org/changelog.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/drk1wi/portspoof/commit/1791fe4e2b9e5b5c8e000551ab60a64a29d924c3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-07-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload \"arbitrarily named\" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-12-01T17:26:34.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2013-025.txt"
},
{
"name": "openSUSE-SU-2013:1561",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00030.html"
},
{
"name": "openSUSE-SU-2013:1579",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00035.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/122719/TWSL2013-025.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://nmap.org/changelog.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/drk1wi/portspoof/commit/1791fe4e2b9e5b5c8e000551ab60a64a29d924c3"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4885",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload \"arbitrarily named\" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.trustwave.com/spiderlabs/advisories/TWSL2013-025.txt",
"refsource": "MISC",
"url": "https://www.trustwave.com/spiderlabs/advisories/TWSL2013-025.txt"
},
{
"name": "openSUSE-SU-2013:1561",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00030.html"
},
{
"name": "openSUSE-SU-2013:1579",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-10/msg00035.html"
},
{
"name": "http://packetstormsecurity.com/files/122719/TWSL2013-025.txt",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/122719/TWSL2013-025.txt"
},
{
"name": "http://nmap.org/changelog.html",
"refsource": "CONFIRM",
"url": "http://nmap.org/changelog.html"
},
{
"name": "https://github.com/drk1wi/portspoof/commit/1791fe4e2b9e5b5c8e000551ab60a64a29d924c3",
"refsource": "MISC",
"url": "https://github.com/drk1wi/portspoof/commit/1791fe4e2b9e5b5c8e000551ab60a64a29d924c3"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4885",
"datePublished": "2013-10-26T17:00:00.000Z",
"dateReserved": "2013-07-22T00:00:00.000Z",
"dateUpdated": "2024-08-06T16:59:40.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}