Lucene search
+L
AmazonMost viewed

9213 matches found

Amazon
Amazon
added 2025/04/29 12:00 a.m.14 views

Medium: java-1.8.0-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to...

5.3CVSS5.3AI score0.08346EPSS
SaveExploits0
Amazon
Amazon
added 2025/04/29 12:00 a.m.14 views

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: btrfs: handle errors from btrfsdecref properly CVE-2024-46753 In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6send CVE-2025-21759 In the Linux kernel,...

7.8CVSS7AI score0.07372EPSS
SaveExploits0
Amazon
Amazon
added 2025/04/29 12:00 a.m.14 views

Medium: docker

Issue Overview: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...

7.5CVSS6.8AI score0.01659EPSS
SaveExploits0
Amazon
Amazon
added 2025/04/16 12:00 a.m.14 views

Important: golang

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

9.1CVSS6.9AI score0.00778EPSS
SaveExploits0
Amazon
Amazon
added 2025/04/14 12:00 a.m.14 views

Important: ghostscript

Issue Overview: PDF interpreter - Guard against unsigned int overflow. A large Type 4 function definition can overflow the uint counter, causing the allocated buffer to be smaller than required. Info: https://bugs.ghostscript.com/showbug.cgi?id=708253 Patch:...

9.8CVSS7.2AI score0.00591EPSS
SaveExploits0
Amazon
Amazon
added 2025/04/14 12:00 a.m.14 views

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization CVE-2024-58092 In the Linux kernel, the following vulnerability has been resolved: keys: Fix UAF in keyput CVE-2025-21893 In the Linux kernel, the following...

7.8CVSS7.2AI score0.0044EPSS
SaveExploits0
Amazon
Amazon
added 2025/04/01 12:00 a.m.14 views

Important: tomcat10

Issue Overview: Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from...

9.8CVSS10AI score0.99927EPSS
SaveExploits49
Amazon
Amazon
added 2025/03/26 12:00 a.m.14 views

Important: ansible-core

Issue Overview: Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker need...

5.4CVSS7.2AI score0.00497EPSS
SaveExploits0
Amazon
Amazon
added 2025/03/26 12:00 a.m.14 views

Medium: java-23-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12...

4.8CVSS6.7AI score0.01149EPSS
SaveExploits0
Amazon
Amazon
added 2025/03/26 12:00 a.m.14 views

Medium: python3.12

Issue Overview: The Python standard library functions urllib.parse.urlsplit and urlparse accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could...

6.3CVSS7.7AI score0.01525EPSS
SaveExploits0
Amazon
Amazon
added 2025/03/25 12:00 a.m.14 views

Medium: golang

Issue Overview: net/http: sensitive headers incorrectly sent after cross-domain redirect The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to...

6.1CVSS6.6AI score0.00658EPSS
SaveExploits2
Amazon
Amazon
added 2025/03/25 12:00 a.m.14 views

Low: python-pip

Issue Overview: The "ipaddress" module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as "globally reachable" or "private". This affected the isprivate and isglobal properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address...

7.5CVSS6.9AI score0.01079EPSS
SaveExploits0
Amazon
Amazon
added 2025/03/25 12:00 a.m.14 views

Medium: python-pillow

Issue Overview: Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library PIL 1.1.7 and earlier allows remote attackers to cause a denial of service crash via a crafted PhotoCD file. CVE-2016-2533 Affected Packages: python-pillow Note: This...

6.5CVSS6.6AI score0.03998EPSS
SaveExploits0
Amazon
Amazon
added 2025/03/06 12:00 a.m.14 views

Medium: php8.2

Issue Overview: The upstream advisory describes this issue as follows: A memory-related vulnerability in PHP's filter handling system, particularly when processing input with convert.quoted-printable-decode filters, leads to a segmentation fault. This vulnerability is triggered through specific...

9.8CVSS8.4AI score0.02286EPSS
SaveExploits6
Amazon
Amazon
added 2025/03/06 12:00 a.m.14 views

Important: kernel

Issue Overview: A flaw was found in hw. Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type, potentially leading to information disclosure. CVE-2022-23825 Non-transparent sharing of return predictor targets between contexts in some IntelR Processors may...

7.8CVSS6.6AI score0.04831EPSS
SaveExploits1
Amazon
Amazon
added 2025/03/06 12:00 a.m.14 views

Important: aws-kinesis-agent

Issue Overview: In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer.deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization...

7.5CVSS8AI score0.02766EPSS
SaveExploits1
Amazon
Amazon
added 2025/03/06 12:00 a.m.14 views

Important: libtirpc

Issue Overview: In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svcrun infinite loop without accepting new connections. CVE-2021-46828 Affected Packages:...

7.5CVSS6.9AI score0.02606EPSS
SaveExploits0
Amazon
Amazon
added 2025/03/06 12:00 a.m.14 views

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: xfs: fix log recovery buffer allocation for the legacy hsize fixup CVE-2024-39472 In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: prefer nftchainvalidate CVE-2024-41042 In...

8.4CVSS7AI score0.0087EPSS
SaveExploits4
Amazon
Amazon
added 2025/03/06 12:00 a.m.14 views

Important: kernel-livepatch-5.10.233-223.887

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Fix slab-use-after-free read in sgrelease CVE-2024-56631 Affected Packages: kernel-livepatch-5.10.233-223.887 Issue Correction: Please ensure you have live patching enabled. Run yum update...

7.8CVSS6.6AI score0.00285EPSS
SaveExploits0
Amazon
Amazon
added 2025/02/21 12:00 a.m.14 views

Low: gsl

Issue Overview: GSL GNU Scientific Library through 2.8 has an integer signedness error in gslsimansolvemany in siman/siman.c. When params.ntries is negative, incorrect memory allocation occurs. CVE-2024-50610 Affected Packages: gsl Issue Correction: Run dnf update gsl --releasever 2023.6.20250218...

3.6CVSS6.9AI score0.00284EPSS
SaveExploits1
Amazon
Amazon
added 2025/02/05 12:00 a.m.14 views

Important: runfinch-finch

Issue Overview: Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to...

9.1CVSS5.9AI score0.03153EPSS
SaveExploits2
Amazon
Amazon
added 2025/02/05 12:00 a.m.14 views

Medium: java-23-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13,...

4.8CVSS4.8AI score0.01007EPSS
SaveExploits0
Amazon
Amazon
added 2025/01/24 12:00 a.m.14 views

Important: tomcat9

Issue Overview: Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write non-default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through...

9.8CVSS10AI score0.44312EPSS
SaveExploits14
Amazon
Amazon
added 2024/12/19 12:00 a.m.14 views

Medium: zziplib

Issue Overview: A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the zzipfetchdisktrailer function at /zzip/zip.c. CVE-2024-39134 Affected Packages: zziplib Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit th...

7.5CVSS6.9AI score0.00604EPSS
SaveExploits1
Amazon
Amazon
added 2024/12/19 12:00 a.m.14 views

Medium: gnome-shell

Issue Overview: In GNOME Shell through 45.7, a portal helper can be launched automatically without user confirmation based on network responses provided by an adversary e.g., an adversary who controls the local Wi-Fi network, and subsequently loads untrusted JavaScript code, which may lead to...

6.5CVSS6.6AI score0.0031EPSS
SaveExploits0
Amazon
Amazon
added 2024/11/01 12:00 a.m.14 views

Important: qt5-qtmultimedia

Issue Overview: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted signal has not ye...

8.6CVSS7.8AI score0.0049EPSS
SaveExploits0
Amazon
Amazon
added 2024/11/01 12:00 a.m.14 views

Important: qt5-qtgraphicaleffects

Issue Overview: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted signal has not ye...

8.6CVSS7.8AI score0.0049EPSS
SaveExploits0
Amazon
Amazon
added 2024/10/31 12:00 a.m.14 views

Medium: java-1.8.0-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12...

4.8CVSS7.3AI score0.01149EPSS
SaveExploits0
Amazon
Amazon
added 2024/10/14 12:00 a.m.14 views

Medium: unbound

Issue Overview: NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying...

5.3CVSS7.2AI score0.00801EPSS
SaveExploits0
Amazon
Amazon
added 2024/10/01 12:00 a.m.14 views

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize CVE-2024-35807 Affected Packages: kernel Issue Correction: Run dnf update kernel --releasever 2023.5.20240916 or dnf update --advisory ALAS2023-2024-715 --releasever...

5.5CVSS6.4AI score0.00269EPSS
SaveExploits0
Amazon
Amazon
added 2024/09/18 12:00 a.m.14 views

Important: kernel-livepatch-5.10.220-209.867

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix double free on error CVE-2024-41087 Affected Packages: kernel-livepatch-5.10.220-209.867 Issue Correction: Please ensure you have live patching enabled. Run yum update...

7.8CVSS6.7AI score0.00244EPSS
SaveExploits0
Amazon
Amazon
added 2024/08/21 12:00 a.m.14 views

Medium: oci-add-hooks

Issue Overview: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed...

7.5CVSS6.9AI score0.91969EPSS
SaveExploits1
Amazon
Amazon
added 2024/08/19 12:00 a.m.14 views

Medium: tpm2-tss

Issue Overview: tpm2-tss: arbitrary quote data may go undetected by FapiVerifyQuote CVE-2024-29040 Affected Packages: tpm2-tss Issue Correction: Run dnf update tpm2-tss --releasever 2023.5.20240819 to update your system. New Packages: aarch64: tpm2-tss-fapi-4.0.2-1.amzn2023.aarch64 ...

4.3CVSS7.4AI score0.00343EPSS
SaveExploits0
Amazon
Amazon
added 2024/08/15 12:00 a.m.14 views

Medium: tpm2-tools

Issue Overview: tpm2-tools: arbitrary quote data may go undetected by tpm2checkquote CVE-2024-29038 tpm2-tools: pcr selection value is not compared with the attest CVE-2024-29039 Affected Packages: tpm2-tools Issue Correction: Run dnf update tpm2-tools --releasever 2023.5.20240805 or dnf update...

9CVSS7AI score0.00984EPSS
SaveExploits2
Amazon
Amazon
added 2024/08/15 12:00 a.m.14 views

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bondoptionarpiptargetsset CVE-2024-39487 In the Linux kernel, the following vulnerability has been resolved: ima: Avoid blocking in RCU read-side critical section CVE-2024-40947 ...

7.8CVSS7AI score0.00872EPSS
SaveExploits0
Amazon
Amazon
added 2024/08/15 12:00 a.m.14 views

Medium: mod_http2

Issue Overview: Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 Affected Packages: modhttp2 Issue Correction: Run dnf update modhttp2 --releasever 2023.5.202408...

5.4CVSS7.2AI score0.01715EPSS
SaveExploits0
Amazon
Amazon
added 2024/08/13 12:00 a.m.14 views

Medium: containerd

Issue Overview: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

9.8CVSS6.9AI score0.01956EPSS
SaveExploits0
Amazon
Amazon
added 2024/08/13 12:00 a.m.14 views

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread one which called recvmsg/sendmsg may exit as soon as the async crypto handler calls complete so any code past that point risks touching...

9.1CVSS6.7AI score0.01401EPSS
SaveExploits0
Amazon
Amazon
added 2024/08/06 12:00 a.m.14 views

Medium: thunderbird

Issue Overview: A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above CVE-2023-6349 Affected Packages: thunderbird Note:...

5.7CVSS7.2AI score0.00365EPSS
SaveExploits1
Amazon
Amazon
added 2024/08/01 12:00 a.m.14 views

Important: docker

Issue Overview: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

9.9CVSS7.2AI score0.16496EPSS
SaveExploits0
Amazon
Amazon
added 2024/07/30 12:00 a.m.14 views

Important: docker

Issue Overview: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

9.9CVSS6.7AI score0.16496EPSS
SaveExploits0
Amazon
Amazon
added 2024/07/22 12:00 a.m.14 views

Important: java-1.8.0-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.1...

7.4CVSS6.4AI score0.01257EPSS
SaveExploits0
Amazon
Amazon
added 2024/06/24 12:00 a.m.14 views

Important: kernel-livepatch-4.14.343-259.562

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv-len is a multiple of 4, then dstlen / 4 can write past the destination array which leads to stack corruption. This construct is necessary to clean th...

7.1CVSS6.7AI score0.00677EPSS
SaveExploits0
Amazon
Amazon
added 2024/06/24 12:00 a.m.14 views

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmiunregisterfunction CVE-2023-52840 In the Linux kernel, the following vulnerability has been resolved: llc: verify mac len before reading mac header CVE-2023-52843 I...

7.8CVSS6.5AI score0.00343EPSS
SaveExploits0
Amazon
Amazon
added 2024/06/24 12:00 a.m.14 views

Important: ecs-service-connect-agent

Issue Overview: Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedgeonpertrytimeout is enabled, 2. pertryidletimeout is enabled it can only be done in configuration, 3...

8.6CVSS7.2AI score0.00751EPSS
SaveExploits0
Amazon
Amazon
added 2024/06/14 12:00 a.m.14 views

Medium: bouncycastle

Issue Overview: An issue was discovered in Bouncy Castle Java Cryptography APIs before ... NOTE: https://github.com/bcgit/bc-java/issues/1635 NOTE: https://www.bouncycastle.org/latestreleases.html DEBIANBUG: 1070655 CVE-2024-29857 An issue was discovered in Bouncy Castle Java Cryptography APIs...

7.5CVSS7.2AI score0.011EPSS
SaveExploits1
Amazon
Amazon
added 2024/05/30 12:00 a.m.14 views

Medium: amazon-ecr-credential-helper

Issue Overview: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed...

7.5CVSS6.9AI score0.91969EPSS
SaveExploits1
Amazon
Amazon
added 2024/05/28 12:00 a.m.14 views

Important: php8.2

Issue Overview: The vulnerability allows a remote attacker to bypass implemented security restrictions. The vulnerability exists due to the way PHP handles HTTP variable names. A remote attacker can set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cook...

6.5CVSS7.9AI score0.49336EPSS
SaveExploits3
Amazon
Amazon
added 2024/05/15 12:00 a.m.14 views

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv-len is a multiple of 4, then dstlen / 4 can write past the destination array which leads to stack corruption. This construct is necessary to clean th...

7.1CVSS6.6AI score0.00677EPSS
SaveExploits0
Amazon
Amazon
added 2024/05/13 12:00 a.m.14 views

Medium: clamav

Issue Overview: A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in ...

7.5CVSS7.6AI score0.33558EPSS
SaveExploits0
Total number of security vulnerabilities5000