Lucene search
+L
RedhatcveMost viewed

214895 matches found

RedhatCVE
RedhatCVE
•added 2022/07/07 8:15 p.m.•62 views

CVE-2022-33980

A flaw was found in Apache Commons Configuration's variable interpolation, which by default included several lookup actions that could permit script invocation on remote servers. This issue could allow an attacker to use one of these actions to send a request to execute arbitrary code on the serv...

7.5CVSS6.8AI score0.4556EPSS
SaveExploits3References3
RedhatCVE
RedhatCVE
•added 2022/06/17 4:29 p.m.•62 views

CVE-2022-1665

A flaw was found in the Linux kernel, where a set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture were signed with Red Hat's production secure boot keys. This issue allows kernel versions targeted for testing to eventually boot in PowerPC environments with...

8.2CVSS2.4AI score0.00265EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/06/07 2:30 a.m.•62 views

CVE-2022-30783

A vulnerability was found in NTFS-3G. An invalid return code in fusekernmount allows libfuse-lite protocol traffic between NTFS-3G and the kernel to be intercepted...

6.7CVSS3.4AI score0.00433EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/05/31 2:53 p.m.•62 views

CVE-2022-31740

The Mozilla Foundation Security Advisory describes this flaw as: On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash...

8.8CVSS3AI score0.00651EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
•added 2022/05/21 12:09 a.m.•62 views

CVE-2022-22935

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master...

4.3CVSS4.5AI score0.01624EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2022/05/18 11:01 p.m.•62 views

CVE-2022-24904

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's...

4.3CVSS1.9AI score0.01133EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/05/18 10:56 p.m.•62 views

CVE-2022-1116

Integer Overflow or Wraparound vulnerability in iouring of Linux Kernel allows local attacker to cause memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to 5.4.189; version 5.4.24 and later versions...

7.8CVSS6.4AI score0.00507EPSS
SaveExploits1References5
RedhatCVE
RedhatCVE
•added 2022/05/18 10:42 p.m.•62 views

CVE-2022-1343

A flaw was found in OpenSSL's Online Certificate Status Protocol OCSP response functionality in the signer certificate verification routines. This flaw could result in a linked application falsely believing that an x.509 Digital Certificate is either "good" or "unknown" when revoked and requires...

5.3CVSS2.6AI score0.01239EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/05/13 8:03 a.m.•63 views

CVE-2022-1677

In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct...

6.3CVSS2.1AI score0.00583EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/05/05 3:55 a.m.•62 views

CVE-2022-29155

A vulnerability was found in the openldap-servers package. A SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This issue occurs during an LDAP search operation when the search filter is processed due to a lack of proper...

9.8CVSS3.1AI score0.64487EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2022/04/28 5:54 p.m.•62 views

CVE-2022-1516

A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system...

5.5CVSS1.7AI score0.00336EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/04/22 4:54 a.m.•62 views

CVE-2022-24272

A flaw was found in the MongoDB database when requesting unexpected queries due to incorrect validation on the $external database. This flaw allows an attacker to cause a denial of service on the database or a server crash...

6.5CVSS3.4AI score0.00925EPSS
SaveExploits2References4
RedhatCVE
RedhatCVE
•added 2022/04/21 10:52 p.m.•62 views

CVE-2022-28327

An integer overflow flaw was found in Golang's crypto/elliptic library. This flaw allows an attacker to use a crafted scaler input longer than 32 bytes, causing P256.ScalarMult or P256.ScalarBaseMult to panic, leading to a loss of availability...

7.5CVSS3.4AI score0.04082EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/03/28 7:47 p.m.•62 views

CVE-2022-24778

A flaw was found in the imgcrypt library when checking the keys of an authorized user to access an encrypted image on systems where layers are not available and cannot run on the host architecture. This flaw allows an attacker to run an image without providing the previously decrypted keys...

7.5CVSS4.2AI score0.02718EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2022/03/03 9:51 p.m.•62 views

CVE-2022-25634

Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory...

7.5CVSS2AI score0.0196EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/02/25 8:00 p.m.•62 views

CVE-2022-24615

zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library...

5.5CVSS4AI score0.00709EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/02/25 3:18 p.m.•62 views

CVE-2022-26126

frrouting is vulnerable to a flaw that can cause stack overflow due to processing binary data as simple string data. Since c string data is not being processed when processing packets , correct binary aware functions should be used. There is high impact to availability due to the fact that the...

7.8CVSS4.1AI score0.0108EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2022/02/17 4:52 p.m.•62 views

CVE-2022-25183

A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries plugin uses the names of Pipeline libraries to create cache directories without any sanitization. This flaw allows attackers with item/configure permission to execute arbitrary code in the context of the Jenkins controller JVM,...

8.8CVSS4AI score0.01571EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/02/17 3:48 p.m.•62 views

CVE-2022-25308

A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of service...

7.8CVSS4.3AI score0.00535EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2022/01/12 11:23 p.m.•62 views

CVE-2022-22751

The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR 91.4. Some of these...

8.8CVSS2.1AI score0.00862EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
•added 2022/01/12 11:22 p.m.•62 views

CVE-2021-43415

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1...

8.8CVSS3.5AI score0.01221EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2021/12/16 10:58 a.m.•62 views

CVE-2021-23177

An improper link resolution flaw while extracting an archive can lead to changing the access control list ACL of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw...

7.8CVSS3.2AI score0.00387EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2021/11/25 8:18 p.m.•62 views

CVE-2021-4023

A flaw was found in the io-workqueue implementation in the Linux kernel. The kernel can panic when an improper cancellation operation triggers the submission of new io-uring operations during a shortage of free space. This flaw allows a local user with permissions to execute io-uring requests to...

5.5CVSS5.9AI score0.00238EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2021/10/21 3:09 p.m.•62 views

CVE-2021-42782

A stack buffer overflow issue was found in the OpenSC package. This flaw can potentially crash programs using the library. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and...

5.3CVSS5.9AI score0.02782EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2021/10/05 5:46 p.m.•62 views

CVE-2021-42008

The decodedata function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAPNETADMIN capability can lead to root access. Mitigation Mitigation for this issue is either not available or the currently available...

7.8CVSS1.8AI score0.01561EPSS
SaveExploits3References3
RedhatCVE
RedhatCVE
•added 2021/10/05 6:06 a.m.•62 views

CVE-2021-20318

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

7.2CVSS3AI score0.06879EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2021/09/30 3:02 p.m.•62 views

CVE-2021-39212

A flaw was found in ImageMagick in the Postscript File Handler component. An attacker could exploit this flaw which would, in some cases, lead to postscript files to be read and written to even when specifically excluded by a module policy in policy.xml. Mitigation Users are advised to use the...

4.4CVSS1AI score0.00353EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2021/09/06 6:05 p.m.•62 views

CVE-2021-39261

The ntfs3g package is susceptible to a heap overflow on crafted input. When processing an NTFS image, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

7.8CVSS2.2AI score0.00452EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2021/08/18 4:32 p.m.•62 views

CVE-2021-38554

A flaw was found in the vault package. The Vault UI web application may fail to completely clear a client-side data cache on user logout. As a result, an authenticated user sharing a browser to access Vault may have been able to view the previous authenticated user’s cached secrets, even if they...

5.3CVSS3.1AI score0.00911EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2021/08/12 10:51 a.m.•62 views

CVE-2021-22939

A flaw was found in Node.js. If the Node.js HTTPS API is used incorrectly and "undefined" is passed for the "rejectUnauthorized" parameter, no error is returned, and the connections to servers with an expired certificate are accepted. The highest threat from this vulnerability is to integrity...

5.3CVSS1.4AI score0.1473EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2021/08/10 10:56 p.m.•62 views

CVE-2021-34485

.NET Core and Visual Studio Information Disclosure Vulnerability...

5.5CVSS1.4AI score0.01455EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
•added 2021/08/09 12:20 p.m.•62 views

CVE-2021-36770

A flaw was found in perl-Encode, where the Perl5 Encode module loaded modules within the current directory. This flaw allows an attacker with write access to the current directory of a Perl5 process to inject arbitrary Perl code when this module is loaded, which can be used for a local privilege...

7.8CVSS1.7AI score0.01392EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2021/07/30 5:50 a.m.•62 views

CVE-2021-3639

A flaw was found in modauthmellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threa...

6.1CVSS2.7AI score0.00966EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2021/07/28 1:53 p.m.•62 views

CVE-2021-30744

Description: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site...

8.1CVSS2.9AI score0.01155EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2021/07/07 9:53 p.m.•62 views

CVE-2021-31810

Ruby's Net::FTP module trusted the IP address included in the FTP server's response to the PASV command. A malicious FTP server could use this to make Ruby applications using the Net::FTP module to connect to arbitrary hosts and use this to perform port scanning or information extraction from...

5.8CVSS1.1AI score0.0305EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2021/05/19 12:27 a.m.•62 views

CVE-2021-29953

A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability. Note: This issue only affected Firefox for Android. Other operating systems are unaffected...

6.1CVSS3.3AI score0.00647EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2021/03/29 6:02 p.m.•62 views

CVE-2021-23358

A flaw was found in nodejs-underscore. Arbitrary code execution via the template function is possible, particularly when a variable property is passed as an argument as it is not sanitized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

7.2CVSS3.9AI score0.04087EPSS
SaveExploits2References3
RedhatCVE
RedhatCVE
•added 2021/01/07 8:14 p.m.•62 views

CVE-2020-36184

A flaw was found in jackson-databind. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigation The following conditions are needed for an exploit, w...

8.8CVSS1.9AI score0.08356EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2020/12/04 6:53 a.m.•62 views

CVE-2020-27822

A flaw was found in Wildfly. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to impact the availability of the server. The highest threat from this vulnerability is to system availability...

7.1CVSS3.2AI score0.01122EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2020/11/10 2:59 a.m.•62 views

CVE-2020-14351

A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integri...

7.8CVSS7.3AI score0.00306EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2020/10/14 9:01 p.m.•62 views

CVE-2020-12352

An information leak flaw was found in the way Linux kernel’s Bluetooth stack implementation handled initialization of stack memory when handling certain AMP Alternate MAC-PHY Manager Protocol packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory o...

6.5CVSS1AI score0.05714EPSS
SaveExploits5References6
RedhatCVE
RedhatCVE
•added 2020/10/05 5:24 a.m.•62 views

CVE-2016-10165

The TypeMLURead function in cmstypes.c in Little CMS aka lcms2 allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read...

5.8CVSS5.2AI score0.02762EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2020/09/22 6:39 p.m.•62 views

CVE-2020-25596

A flaw was found in Xen. One of Xen's sanitization paths injects a GP fault and incorrectly delivers it twice to the guest. This flaw allows malicious or buggy user space to crash the guest kernel, resulting in a VM denial of service. Mitigation Running only x86 PVH/HVM guests avoids the...

5.5CVSS4.7AI score0.00512EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2020/09/07 10:19 a.m.•62 views

CVE-2020-3902

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. Processing maliciously crafted web content may lead to a cross site...

4.3CVSS2.1AI score0.01153EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2020/08/18 7:29 p.m.•62 views

CVE-2020-8911

A flaw was found in the AWS S3 Crypto SDK that allows users to encrypt files stored in S3 buckets with AES-CBC, without computing a MAC on the data. This allows for a padding oracle, enabling attackers with both write access to the target S3 bucket and the ability to observe the result of valid...

2.1CVSS4.3AI score0.00346EPSS
SaveExploits1References5
RedhatCVE
RedhatCVE
•added 2020/04/08 5:15 p.m.•62 views

CVE-2016-7097

It was found that when file permissions were modified via chmod and the user modifying them was not in the owning group or capable of CAPFSETID, the setgid bit would be cleared. Setting a POSIX ACL via setxattr sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in ...

4.4CVSS3.1AI score0.00392EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2020/04/07 5:03 p.m.•62 views

CVE-2019-10747

A flaw was found in nodejs-set-value. The function mixin-deep can be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or proto payloads. The highest threat from this vulnerability is to data confidentiality and integrity...

9.8CVSS3.1AI score0.05006EPSS
SaveExploits5References3
RedhatCVE
RedhatCVE
•added 2020/04/04 11:14 p.m.•62 views

CVE-2019-12818

An issue was discovered in the Linux kernel before 4.20.15. The nfcllcpbuildtlv function in net/nfc/llcpcommands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This affects nfcllcpbuildgb in net/nfc/llcpcore...

7.5CVSS3.4AI score0.06006EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2020/03/29 2:10 a.m.•62 views

CVE-2019-16935

A reflected cross-site scripting XSS vulnerability was found in Python XML-RPC server. The servertitle field is not sufficiently sanitized allowing malicious JavaScript to be injected. Successful exploitation would allow a remote attacker to execute JavaScript code within the context of the...

6.1CVSS2.7AI score0.04653EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2020/02/02 2:38 p.m.•62 views

CVE-2019-15031

A flaw in the Linux kernel on the PowerPC platform, was found where a local user can read vector registers of other user processes during a hardware interrupt. An attacker must start a transaction when the FPU operation begins or there is no leakage. Vector registers will become corrupted with...

4.4CVSS2AI score0.00555EPSS
SaveExploits1References3
Total number of security vulnerabilities5000