Lucene search
+L
RedhatcveMost viewed

211281 matches found

RedhatCVE
RedhatCVE
•added 2022/10/13 5:1 p.m.•57 views

CVE-2022-42722

A flaw was found in P2P-Device in wifi in ieee80211rxhdecrypt in net/mac80211/rx.c in the Linux kernel, leading to a denial of service. Mitigation To mitigate this issue, prevent module mac80211 from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel...

5.5CVSS6.5AI score0.00571EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2022/10/13 1:29 p.m.•57 views

CVE-2022-41674

A buffer overflow flaw was found in the u8 overflow in cfg80211updatenotlistednontrans in net/wireless/scan.c in the Linux kernel’s wifi subcomponent. This flaw allows an attacker to crash the system or leak internal kernel information. Mitigation Mitigation for this issue is either not available...

7.3CVSS8AI score0.03872EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2022/09/26 12:19 p.m.•57 views

CVE-2022-3278

A NULL pointer dereference vulnerability was found in Vim's evalnextnonblank function of the src/eval.c file. The flaw occurs when using NUL in buffer uses :source. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a NULL pointer dereference that cause...

5.5CVSS3.2AI score0.00851EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2022/08/30 6:6 a.m.•57 views

CVE-2022-30689

HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3...

5.3CVSS1.8AI score0.01159EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/08/09 3:36 p.m.•57 views

CVE-2022-2047

A flaw was found in Eclipse Jetty. When parsing the authority segment of an HTTP scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This issue can lead to failures in a Proxy scenario...

2.7CVSS0.5AI score0.01173EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/07/15 10:32 a.m.•57 views

CVE-2022-30631

A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion...

7.5CVSS1.7AI score0.01936EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
•added 2022/06/23 2:36 p.m.•57 views

CVE-2021-38561

A flaw was found in golang. The language package for go language can panic due to an out-of-bounds read when an incorrectly formatted language tag is being parsed. This flaw allows an attacker to cause applications using this package to parse untrusted input data to crash, leading to a denial of...

7.5CVSS4.3AI score0.01356EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/06/07 2:30 a.m.•57 views

CVE-2022-30785

A vulnerability was found in NTFS-3G. A file handle created in fuselibopendir and later used in fuselibreaddir allows out-of-bounds read/write operations...

7.2CVSS1.5AI score0.00396EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/05/31 4:22 a.m.•57 views

CVE-2022-1949

A flaw was found in the 389-ds-base package where some LDAP queries can cause performance issues. This flaw allows an attacker to send a non-optimal search that causes serious performance issues within the directory server...

7.5CVSS2.9AI score0.01466EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/05/25 2:33 p.m.•57 views

CVE-2022-1871

No description is available for this CVE...

1.3AI score0.00551EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2022/05/25 2:30 p.m.•57 views

CVE-2022-1856

No description is available for this CVE...

1.3AI score0.0058EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2022/05/21 12:16 a.m.•57 views

CVE-2021-32918

An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service DoS attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3...

7.5CVSS3.7AI score0.02115EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
•added 2022/05/20 11:15 p.m.•57 views

CVE-2021-38000

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page...

8.8CVSS4.2AI score0.04653EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
•added 2022/05/20 10:39 p.m.•57 views

CVE-2019-6799

An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfile PHP...

9.8CVSS3.1AI score0.14829EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
•added 2022/05/18 5:24 p.m.•57 views

CVE-2021-36203

The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request...

9.1CVSS4.3AI score0.00834EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
•added 2022/05/14 11:41 a.m.•57 views

CVE-2020-7238

A flaw was found in Netty, where it mishandles Transfer-Encoding whitespace. This flaw allows HTTP Request Smuggling. Mitigation Use HTTP/2 instead clear boundaries between requests Disable reuse of backend connections eg. http-reuse never in HAProxy or whatever equivalent LB settings...

7.5CVSS1.1AI score0.08415EPSS
SaveExploits2References4
RedhatCVE
RedhatCVE
•added 2022/05/13 8:3 a.m.•58 views

CVE-2022-1677

In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct...

6.3CVSS2.1AI score0.00521EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/05/07 2:12 p.m.•57 views

CVE-2021-44716

There's an uncontrolled resource consumption flaw in golang's net/http library in the canonicalHeader function. An attacker who submits specially crafted requests to applications linked with net/http's http2 functionality could cause excessive resource consumption that could lead to a denial of...

7.5CVSS3AI score0.03958EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/05/07 2:9 p.m.•57 views

CVE-2021-44717

There's a flaw in golang's syscall.ForkExec interface. An attacker who manages to first cause a file descriptor exhaustion for the process, then cause syscall.ForkExec to be called repeatedly, could compromise data integrity and/or confidentiality in a somewhat uncontrolled way in programs linked...

5.8CVSS3.2AI score0.01857EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/04/29 12:46 p.m.•57 views

CVE-2022-29810

A flaw was found in go-getter, where the go-getter library can write SSH credentials into its log file. This flaw allows a local user with access to read log files to read sensitive credentials, which may lead to privilege escalation or account takeover...

5.5CVSS3.3AI score0.00403EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2022/04/26 5:33 a.m.•57 views

CVE-2022-27455

A flaw was found in the MariaDB Server. It contains a use-after-free in the component, mywildcmp8bitimpl at /strings/ctype-simple.c, affecting availability...

7.5CVSS3.1AI score0.01564EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2022/04/20 2:57 p.m.•57 views

CVE-2022-28048

STB v2.27 was discovered to contain an integer shift of invalid size in the component stbijpegdecodeblockprogac...

8.8CVSS1.5AI score0.01557EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2022/04/14 10:38 p.m.•57 views

CVE-2022-27456

A flaw was found in the MariaDB Server. It contains a use-after-free in the component, VDec::VDec at /sql/sqltype.cc, affecting availability...

7.5CVSS3AI score0.02125EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2022/03/15 8:8 a.m.•57 views

CVE-2022-0907

A NULL pointer dereference flaw was found in Libtiff. This flaw allows an attacker with a crafted TIFF file to cause a crash that leads to a denial of service...

5.5CVSS5.8AI score0.0127EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2022/03/11 6:14 p.m.•57 views

CVE-2022-26336

A shortcoming in the HMEF package of poi-scratchpad Apache POI allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files Microsoft Outlook and Microsoft Exchange Server. If an application uses poi-scratchpad to parse TNEF files and the application allows...

5.5CVSS3.7AI score0.0152EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/03/08 1:43 p.m.•57 views

CVE-2022-26485

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: Removing an XSLT parameter during processing could have led to an exploitable use-after-free issue. There were reports of attacks in the wild abusing this flaw...

8.8CVSS1.7AI score0.13797EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2022/03/02 10:53 a.m.•57 views

CVE-2022-25375

An information disclosure vulnerability was found in the Linux kernel. The RNDIS USB gadget lacks validation of the size of the RNDISMSGSET command. This flaw allows a local attacker to dump contents of kernel memory space via a packet filter update mechanism and potentially extract sensitive...

5.5CVSS3.5AI score0.01054EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2022/02/25 6:48 a.m.•57 views

CVE-2022-0554

A flaw was found in vim that causes an out-of-range pointer offset vulnerability. This flaw allows an attacker to input a specially crafted file, leading to a crash or code execution. Mitigation Untrusted vim scripts with -s scriptin are not recommended to run...

8.4CVSS3.8AI score0.01607EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2022/02/17 5:1 p.m.•57 views

CVE-2022-25184

A flaw was found in Jenkins pipeline-build-step where it revealed password parameter default values when generating a pipeline script using the Pipeline snippet generator. This flaw allows attackers with item/read permission to retrieve the default password parameter value from jobs and compromis...

6.5CVSS4.4AI score0.00876EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/02/17 4:38 p.m.•57 views

CVE-2022-25176

A flaw was found in Jenkins. The Pipeline: Groovy Plugin follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file typically Jenkinsfile for Pipelines. This flaw allows attackers who can configure Pipelines to read arbitrary files on...

6.5CVSS3.2AI score0.01742EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/02/15 5:47 p.m.•57 views

CVE-2021-45346

A memory leak flaw was found in the SQLite Project via maliciously crafted SQL Queries made via editing the Database File. This flaw allows a malicious user to obtain sensitive information due to a possible query to a record and leaking subsequent bytes of memory that extend beyond the record...

4.3CVSS2.7AI score0.01614EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2022/02/14 3:26 p.m.•57 views

CVE-2022-0572

A heap-based buffer overflow flaw was found in vim's exretab function of indent.c file. This flaw occurs when repeatedly using ":retab." This flaw allows an attacker to trick a user into opening a crafted file triggering a heap-overflow. Mitigation Untrusted vim scripts with -s scriptin are not...

8.4CVSS3.8AI score0.26583EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2022/02/03 4:31 a.m.•57 views

CVE-2021-46661

MariaDB through 10.5.9 allows an application crash in findfieldintables and findorderinlist via an unused common table expression CTE...

5.5CVSS3.7AI score0.00403EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2022/01/18 10:31 p.m.•57 views

CVE-2022-21341

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability...

5.3CVSS4.7AI score0.03765EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2022/01/13 6:56 a.m.•57 views

CVE-2019-11734

Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox 69...

9.8CVSS3.3AI score0.01295EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2021/12/27 5:55 p.m.•57 views

CVE-2021-4180

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the wwwauthenticateuri parameter which is visible to all end users in configuration files. This would give sensitive...

4.3CVSS3AI score0.00785EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2021/12/20 1:20 p.m.•57 views

CVE-2021-4135

A flaw memory leak in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsimmapallocelem being called. A local user could use this flaw to get unauthorized access to some data. Mitigation The default Red Hat Enterprise...

5.5CVSS2.1AI score0.00231EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2021/10/21 3:34 p.m.•57 views

CVE-2021-42779

A heap use after free issue was found in Opensc before version 0.22.0 in scfilevalid...

5.3CVSS0.9AI score0.021EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2021/09/21 7:10 p.m.•57 views

CVE-2021-32280

The transfig package is susceptible to a NULL pointer dereference on crafted input. While translating fig code, patterns which include incomplete closed splines lead to this software flaw. The highest threat from this vulnerability is availability...

4.3CVSS1.6AI score0.01021EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2021/09/17 6:35 p.m.•57 views

CVE-2020-21535

In transfig's fig2dev 3.2.7b it is possible for an attacker to create a specially crafted file that causes a buffer overflow due to the usage of fgets. This leads to a denial of service, impacting availability of the program...

5.5CVSS4.3AI score0.00891EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2021/08/31 6:49 p.m.•57 views

CVE-2021-23434

Prototype pollution has been discovered in object-path NodeJS library. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === 'proto' returns false if currentPath is 'proto'...

9.8CVSS2AI score0.01902EPSS
SaveExploits1References5
RedhatCVE
RedhatCVE
•added 2021/08/24 10:14 p.m.•57 views

CVE-2021-32781

An out-of-bounds memory read vulnerability was found in envoyproxy/envoy. When using one of the following envoy extensions, it is possible to modify and increase the request or response body size of the following: the decompressor, json-transcoder, grpc-web, or other proprietary extensions. This...

8.6CVSS3.1AI score0.0133EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2021/08/11 6:20 p.m.•57 views

CVE-2020-21682

A global buffer overflow in the setfill component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service DOS via converting a xfig file into ge format...

5.5CVSS4.6AI score0.00849EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2021/08/02 3:50 p.m.•57 views

CVE-2021-3622

A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry hive file, which would cause hivex to recursively call the getchildren function, leading to a stack overflow. The highest threat from this vulnerability is to system availability...

4.3CVSS2.5AI score0.04794EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2021/07/28 1:53 p.m.•57 views

CVE-2021-30761

A flaw was found in the webkitgtk package. Affected versions of this package could allow a remote attacker to execute arbitrary code on the system caused by memory corruption in the WebKit component. By persuading a victim to visit a specially crafted Web site, an attacker could exploit this...

8.8CVSS7.4AI score0.10545EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
•added 2021/07/08 10:51 a.m.•57 views

CVE-2021-35197

An improper authorization vulnerability was found in mediawiki. Mediawiki bots may have unintended API access even when a sitewide block has been applied. An attacker can use this vulnerability to potentially utilize a bot to access the mediawiki API and conduct actions like purge pages...

7.5CVSS4AI score0.01943EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
•added 2021/05/19 12:25 a.m.•57 views

CVE-2021-22904

A flaw was found in RubyGem Actionpack which is framework for handling and responding to web requests in Rails. A possible DoS vulnerability was found in the Token Authentication logic in Action Controller...

7.5CVSS1.7AI score0.04808EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
•added 2021/05/13 5:59 p.m.•57 views

CVE-2020-36328

A flaw was found in libwebp. A heap-based buffer overflow in functions WebPDecodeInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

9.8CVSS3.1AI score0.02662EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2021/05/11 8:55 p.m.•57 views

CVE-2021-28677

A flaw was found in python-pillow. The readline used in EPS has to deal with any combination of \r and \n as line endings. It accidentally used a quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a denial-of-service of Pillow in...

7.5CVSS1AI score0.02293EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2021/03/10 5:3 p.m.•57 views

CVE-2020-13959

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to...

6.5CVSS2AI score0.05723EPSS
SaveExploits0References3
Total number of security vulnerabilities5000