Arbitrary Code Execution

github.com/helm/helm is vulnerable to arbitrary code execution. Duplicate plugin entries allows an attacker to compromise a plugin's install hooks, via a man-in-the-middle attack, and possibly execute arbitrary code on the host OS...

Arbitrary Code Execution

webkit2gtk3 is vulnerable to arbitrary code execution. An attacker is able to execute arbitrary code on the host OS by providing malicious web content which will result in memory corruption...

Arbitrary Code Execution

libxml2.so is vulnerable to arbitrary code execution. An integer overflow occurs when comparing schema dates. This could potentially result in arbitrary code execution on the host OS...

Remote Code Execution

An attacker is able to inject and execute arbitrary code on the host OS if the response can be manipulated for a request being made by the CachingHttpClient...

OS Command Injection

bestzip is vulnerable to OS command injection. A remote attacker is able to inject and execute arbitrary OS commands on the host OS via the destination parameter...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. A memory corruption issue can potentially allow an attacker to execute arbitrary code on the host OS...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. A memory corruption issue can potentially allow an attacker to execute arbitrary code on the host OS...

Remote Code Execution (RCE)

vboxmanage.js is vulnerable to remote code execution RCE. Inadequate escaping of dangerous characters allows an attacker to inject and execute arbitrary OS commands on the host OS via the command arguments...

Arbitrary Code Execution

webkit2gtk is vulnerable to arbitrary code execution. A memory corruption issue allows an attacker to execute arbitrary code on the host OS via malicious web content...

CVE-2020-15566

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: 1 port is already in use, 2 the memory allocation failed, or...

CVE-2020-15566

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: 1 port is already in use, 2 the memory allocation failed, or...

Design/Logic Flaw

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: 1 port is already in use, 2 the memory allocation failed, or...

CVE-2020-15566

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: 1 port is already in use, 2 the memory allocation failed, or...

CVE-2020-15566: Improper Check for Unusual or Exceptional Conditions

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: 1 port is already in use, 2 the memory allocation failed, or...

CVE-2020-8907

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "docker" group, an attacker with this role is able to run docker and...

Design/Logic Flaw

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "docker" group, an attacker with this role is able to run docker and...

CVE-2020-8907

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "docker" group, an attacker with this role is able to run docker and...

CVE-2020-8907

Removed by vendor...

FreeBSD : Mbed TLS -- Cache attack against RSA key import in SGX (056ea107-5729-11ea-a2f3-001cc0382b2f)

Janos Follath reports : If Mbed TLS is running in an SGX enclave and the adversary has control of the main operating system, they can launch a side channel attack to recover the RSA private key when it is being imported. The attack only requires access to fine grained measurements to cache usage...

CVE-2019-19580

An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations, because of an incomplete fix for CVE-2019-18421. XSA-299 addressed several critical issues in restartable PV type...