Lucene search
+L
RedhatcveMost viewed

210449 matches found

RedhatCVE
RedhatCVE
added 2019/10/12 1:22 a.m.116 views

CVE-2018-1273

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...

9.8CVSS4.3AI score0.95649EPSS
SaveExploits9References2
RedhatCVE
RedhatCVE
added 2024/04/04 2:28 p.m.115 views

CVE-2023-1973

A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory...

7.5CVSS6.7AI score0.01284EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2024/03/25 12:35 p.m.115 views

CVE-2024-29059

.NET Framework Information Disclosure Vulnerability...

7.5CVSS7.1AI score0.98624EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
added 2023/12/18 8:27 p.m.115 views

CVE-2023-6817

A use-after-free flaw was found in the Netfilter subsystem in the Linux kernel via the nftpipapowalk function. This issue may allow a local user with CAPNETADMIN capability to trigger an application crash, information disclosure, or local privilege escalation. Mitigation In order to trigger the...

7.8CVSS7.5AI score0.12966EPSS
SaveExploits8References4
RedhatCVE
RedhatCVE
added 2023/10/25 11:57 a.m.115 views

CVE-2023-5363

A flaw was found in OpenSSL in how it processes key and initialization vector IV lengths. This issue can lead to potential truncation or overruns during the initialization of some symmetric ciphers. A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality...

7.5CVSS7.2AI score0.03332EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2023/10/18 12:59 a.m.115 views

CVE-2023-45871

A flaw was found in igbconfigurerxring in drivers/net/ethernet/intel/igb/igbmain.c in the IGB driver in the Linux kernel. An overflow of the contents from a packet that is too large will overflow into the kernel's ring buffer, leading to a system integrity issue. Mitigation Mitigation for this...

7.5CVSS8AI score0.00544EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2023/09/07 8:40 p.m.115 views

CVE-2023-4207

There are 3 CVEs for the use-after-free flaw found in net/sched/clsfw.c in classifiers clsfw, clsu32, and clsroute in the Linux Kernel: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. A local user could use any of these flaws to crash the system or potentially escalate their privileges on the system...

7.8CVSS7.3AI score0.00565EPSS
SaveExploits0References7
RedhatCVE
RedhatCVE
added 2023/05/26 5:10 p.m.115 views

CVE-2023-24824

A flaw was found in CommonMarker. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service...

7.5CVSS6.8AI score0.01027EPSS
SaveExploits2References4
RedhatCVE
RedhatCVE
added 2022/07/18 12:47 p.m.115 views

CVE-2022-33743

An incomplete cleanup flaw was found in the Linux kernel’s Xen networking XDP eXpress Data Path subsystem. This flaw allows a local user to crash the system...

7.8CVSS2.2AI score0.00349EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2022/05/20 11:0 p.m.115 views

CVE-2021-44731

A race condition vulnerability in the snap-confine component setupprivatemount of snapd was found by Qualys. This flaw could lead to local privilege escalation from any user to root...

7.8CVSS3.3AI score0.00944EPSS
SaveExploits4References2
RedhatCVE
RedhatCVE
added 2022/03/16 8:56 p.m.115 views

CVE-2022-0396

A flaw was found in Bind that incorrectly handles certain crafted TCP streams. The vulnerability allows TCP connection slots to be consumed for an indefinite time frame via a specifically crafted TCP stream sent from a client. This flaw allows a remote attacker to send specially crafted TCP strea...

5.3CVSS5.8AI score0.02703EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2024/09/04 12:11 p.m.114 views

CVE-2024-6119

A flaw was found in OpenSSL. Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Mitigation Mitigation for this issue is either not available or t...

5.9CVSS7.2AI score0.66582EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2023/08/29 1:46 p.m.114 views

CVE-2021-30047

VSFTPD is vulnerable to a denial of service, caused by only a limited number of connections allowed, a remote attacker could exploit this vulnerability to cause a denial of service condition...

7.5CVSS7.1AI score0.03073EPSS
SaveExploits1References3
RedhatCVE
RedhatCVE
added 2022/10/26 5:23 p.m.114 views

CVE-2022-35260

A vulnerability was found in curl. The issue occurs when curl is told to parse a .netrc file for credentials. If that file ends in a line with consecutive non-white space letters and no newline, curl could read past the end of the stack-based buffer, and if the read works, it can write a zero byt...

5.3CVSS7.6AI score0.01761EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
added 2022/03/09 12:42 p.m.114 views

CVE-2022-26383

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification...

7.5CVSS1.7AI score0.00655EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2022/02/11 2:23 p.m.114 views

CVE-2022-24959

A memory leak was found in the yamsiocdevprivate function of the YAM driver for AX.25. This issue can result in a denial of service. Mitigation Mitigation for this issue is either not available or the currently available options dont meet the Red Hat Product Security criteria comprising ease of u...

5.5CVSS1.6AI score0.00428EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2021/06/13 5:52 a.m.114 views

CVE-2021-20182

A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted environment instead of runc. If an attacker can gain access to this build container, they can potentially utilize the raw devices of the underlying node, such as...

8.8CVSS2.3AI score0.01145EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2021/05/26 9:12 a.m.114 views

CVE-2021-29509

A flaw was found in rubygem-puma. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections...

7.5CVSS1.1AI score0.02014EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2025/04/25 1:20 p.m.113 views

CVE-2024-32752

The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow an attacker to gain unauthorized access...

9.1CVSS7AI score0.00591EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2023/02/15 7:29 a.m.113 views

CVE-2023-23529

A vulnerability was found in WebKitGTK. This issue occurs when processing maliciously crafted web content in WebKit. This may, in theory, allow a remote attacker to create a specially crafted web page, trick the victim into opening it, trigger type confusion, and execute arbitrary code on the...

8.8CVSS8.7AI score0.09502EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2023/01/23 11:7 a.m.113 views

CVE-2023-0266

A use-after-free flaw was found in sndctlelemread in sound/core/control.c in Advanced Linux Sound Architecture ALSA subsystem in the Linux kernel. In this flaw a normal privileged, local attacker may impact the system due to a locking issue in the compat path, leading to a kernel information leak...

7.9CVSS7.3AI score0.03702EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2023/01/18 5:5 p.m.113 views

CVE-2022-36437

A flaw was found in Hazelcast and Hazelcast Jet. This flaw may allow an attacker unauthenticated access to manipulate data in the cluster...

9.1CVSS3AI score0.01021EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2022/10/14 5:29 a.m.113 views

CVE-2022-3140

A vulnerability was found in LibreOffice that affects the Office URI Schemes. These schemes enable browser integration of LibreOffice with the MS SharePoint server. In LibreOffice, the links using the scheme 'vnd.libreoffice.command' could be constructed to call internal macros with arbitrary...

5.3CVSS2.2AI score0.05533EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2022/08/07 4:6 p.m.113 views

CVE-2022-36946

A memory corruption flaw was found in the Linux kernel’s Netfilter subsystem in the way a local user uses the libnetfilterqueue when analyzing a corrupted network packet. This flaw allows a local user to crash the system or a remote user to crash the system when the libnetfilterqueue is used by a...

6.2CVSS7.5AI score0.07156EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
added 2022/08/03 3:10 p.m.113 views

CVE-2022-20141

A use-after-free flaw was found in the Linux kernel’s IGMP protocol in how a user triggers a race condition in the ipcheckmcrcu function. This flaw allows a local user to crash or potentially escalate their privileges on the system...

7CVSS6.9AI score0.00143EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2022/05/13 12:45 a.m.113 views

CVE-2022-1650

A flaw was found in the EventSource NPM Package. The description from the source states the following message: "Exposure of Sensitive Information to an Unauthorized Actor." This flaw allows an attacker to steal the user's credentials and then use the credentials to access the legitimate website...

9.3CVSS2.8AI score0.01852EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
added 2022/01/13 6:38 a.m.113 views

CVE-2018-14718

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using slf4j classes. An attacker could use this flaw to execute arbitrary code...

9.8CVSS4AI score0.14796EPSS
SaveExploits1References2
RedhatCVE
RedhatCVE
added 2021/11/29 7:31 a.m.113 views

CVE-2021-4028

A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing for a list element to be used after free. Given the ability to execute code, a local attacker could leverage this...

7.8CVSS1.7AI score0.00302EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2021/05/28 12:47 a.m.113 views

CVE-2021-33196

A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files...

7.5CVSS3.5AI score0.03464EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
added 2019/06/11 6:20 a.m.113 views

CVE-2019-8457

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode function when handling invalid rtree tables...

9.8CVSS1.3AI score0.45426EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2017/07/12 5:50 a.m.113 views

CVE-2017-7529

A flaw within the processing of ranged HTTP requests has been discovered in the range filter module of nginx. A remote attacker could possibly exploit this flaw to disclose parts of the cache file header, or, if used in combination with third party modules, disclose potentially sensitive memory b...

7.5CVSS1.3AI score0.62597EPSS
SaveExploits6References2
RedhatCVE
RedhatCVE
added 2024/04/04 7:32 p.m.112 views

CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers, resulting in an HTTP response splitting. Mitigation Mitigation for this issue is either not available or t...

6.8CVSS7.1AI score0.03914EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2023/10/27 8:57 a.m.112 views

CVE-2023-46847

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication...

8.6CVSS7.3AI score0.88351EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2023/09/08 3:5 p.m.112 views

CVE-2023-4807

A vulnerability was found in OpenSSL. The security issue occurs in the POLY1305 MAC message authentication code implementation, that contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X8664 processors supporting the AVX512-IFMA...

7.8CVSS6.3AI score0.00862EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2022/10/14 8:22 a.m.112 views

CVE-2022-3358

A flaw was found in OpenSSL, where it incorrectly handles legacy custom ciphers passed to the EVPEncryptInitex2, EVPDecryptInitex2 and EVPCipherInitex2 functions as well as other similarly named encryption and decryption initialization functions. Instead of using the custom cipher directly, it...

7.5CVSS7.3AI score0.03087EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2022/08/23 1:9 p.m.112 views

CVE-2021-28861

A vulnerability was found in python. This security flaw causes an open redirection vulnerability in lib/http/server.py due to no protection against multiple / at the beginning of the URI path. This issue may lead to information disclosure...

7.4CVSS1.3AI score0.02031EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2022/05/14 11:38 a.m.112 views

CVE-2020-10968

A flaw was found in jackson-databind 2.x prior to version 2.9.10.4. The interaction between serialization gadgets and typing is mishandled in the bus-proxy. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Mitigation The following...

8.8CVSS3.6AI score0.03626EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2022/04/27 6:53 a.m.112 views

CVE-2022-22576

A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials set for this transfer. This issue leads to an authentication bypass, either by mistake or by a malicious...

8.1CVSS3.5AI score0.02161EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
added 2022/03/15 11:44 a.m.112 views

CVE-2022-0084

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk...

7.5CVSS2.8AI score0.01189EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2021/07/13 7:25 p.m.112 views

CVE-2021-21781

An information disclosure flaw exists in the ARM SIGPAGE functionality of the Linux kernel. An attacker with a local account can read the contents of the sigpage, which contains previously initialized kernel memory contents. This flaw requires an attacker to read a process’s memory at a specific...

4CVSS1.7AI score0.00496EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
added 2021/07/08 3:32 p.m.112 views

CVE-2021-21362

A flaw has been identified in minio https://github.com/minio/minio. It is possible to bypass a readOnly policy by creating a temporary 'mc share upload'...

7.7CVSS0.7AI score0.01321EPSS
SaveExploits1References7
RedhatCVE
RedhatCVE
added 2021/07/01 5:23 p.m.112 views

CVE-2021-35942

An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially crafted untrusted regular expression input. Mitigation Do not use untrusted regular expression input for the wordexp function...

9.1CVSS9.3AI score0.02678EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2021/05/28 12:47 a.m.112 views

CVE-2021-22543

A flaw was found in the Linux kernel’s KVM implementation, where improper handing of the VMIO|VMPFNMAP VMAs in KVM bypasses RO checks and leads to pages being freed while still accessible by the VMM and guest. This flaw allows users who can start and control a VM to read/write random pages of...

8.7CVSS1.3AI score0.0066EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
added 2024/01/15 6:31 p.m.111 views

CVE-2023-6237

A flaw was found in OpenSSL. When the EVPPKEYpubliccheck function is called in RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is a large...

5.9CVSS6.9AI score0.02303EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2023/08/30 6:45 a.m.111 views

CVE-2023-4513

A denial of service vulnerability was found in Wireshark due to a memory leak in the Bluetooth SDP dissector. This issue may allow a remote attacker to induce a crash in Wireshark by injecting a malformed packet onto the wire or persuading someone to read a corrupted packet trace file...

6.5CVSS7.2AI score0.00486EPSS
SaveExploits1References5
RedhatCVE
RedhatCVE
added 2023/08/07 1:20 p.m.111 views

CVE-2023-32629

A flaw was found in the Linux Kernel where the OverlayFS implementation in the Ubuntu Linux kernel did not properly perform permission checks in certain situations. This flaw allows a local attacker to gain elevated privileges due to skipped permission in checking for trusted.overlayfs. xattrs...

7.8CVSS6.9AI score0.16052EPSS
SaveExploits14References6
RedhatCVE
RedhatCVE
added 2022/03/11 3:24 p.m.111 views

CVE-2021-39698

A vulnerability was found in the Linux kernel’s file polling implementation in kernel/sched/wait.c., which leads to a use-after-free problem. This flaw allows a local user to cause a denial of service memory corruption or crash or privilege escalation. Mitigation Mitigation for this issue is eith...

7.8CVSS1.7AI score0.00247EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2021/09/07 10:58 a.m.111 views

CVE-2017-18638

A flaw was found in graphite-web. The sendemail in the graphite-web/webapp/graphite/composer/views.py function is vulnerable to a Server-side request forgery SSRF. This flaw allows an attacker to use the vulnerable SSRF endpoint to have the Graphite web server request any resource. An attacker ca...

7.5CVSS3.4AI score0.16316EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
added 2019/10/29 4:34 p.m.111 views

CVE-2019-11043

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution. Mitigation...

9.8CVSS4AI score0.99407EPSS
SaveExploits56References4
RedhatCVE
RedhatCVE
added 2018/07/18 10:14 a.m.111 views

CVE-2018-3060

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.7.22 and prior and 8.0.11 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

6.5CVSS2.6AI score0.02947EPSS
SaveExploits0References2
Total number of security vulnerabilities5000