Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
tor vulnerabilities and exploits
(subscribe to this query)
5
CVSSv2
CVE-2021-34549
An issue exists in Tor prior to 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency.
Torproject Tor
5
CVSSv2
CVE-2021-34550
An issue exists in Tor prior to 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor
Torproject Tor
5
CVSSv2
CVE-2018-0491
A use-after-free issue exists in Tor 0.3.2.x prior to 0.3.2.10. It allows remote malicious users to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list.
Torproject Tor
1 EDB exploit
5
CVSSv2
CVE-2017-0375
The hidden-service feature in Tor prior to 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell.
Torproject Tor
2.1
CVSSv2
CVE-2021-46702
Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local malicious users to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by analyzing ...
Torproject Tor 9.0.7
1 Github repository
5
CVSSv2
CVE-2019-13075
Tor Browser up to and including 8.5.3 has an information exposure vulnerability. It allows remote malicious users to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a LINK element for ...
Torproject Tor Browser
4.3
CVSSv2
CVE-2019-12383
Tor Browser prior to 8.0.1 has an information exposure vulnerability. It allows remote malicious users to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting.
Torproject Tor Browser
5
CVSSv2
CVE-2017-11565
debian/tor.init in the Debian tor_0.2.9.11-1~deb9u1 package for Tor was designed to execute aa-exec from the standard system pathname if the apparmor package is installed, but implements this incorrectly (with a wrong assumption that the specific pathname would remain the same fo...
Debian Tor 0.2.9.11-1
7.5
CVSSv2
CVE-2018-16983
NoScript Classic prior to 5.1.8.7, as used in Tor Browser 7.x and other products, allows malicious users to bypass script blocking via the text/html;/json Content-Type value.
Noscript Noscript
Torproject Tor Browser
5.4
CVSSv2
CVE-2014-5572
The Jazzpodium De Tor (aka com.appmakr.app273713) application 206160 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle malicious users to spoof servers and obtain sensitive information via a crafted certificate.
Jazzpodiumdetor Jazzpodium De Tor 206160
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
spoof
CVE-2024-34928
CVE-2024-5291
deserialization
CVE-2024-4471
CVE-2024-4956
CVE-2024-32002
CVE-2024-5227
unspecified
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
5
6
7
8
9
10
NEXT »