Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2022-23219

glibc: Stack-based buffer overflow in sunrpc clnt_create via a long pathname

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

CVSS 3.1 · 9.8 Critical EPSS 5.0% KEV · Not listed
Vendors
Debian Gnu Oracle and 1 more
Products
Debian Linux Glibc Communications Cloud Native Core Binding Support Function and 6 more
CVE-2022-23218

glibc: Stack-based buffer overflow in svcunix_create via long pathnames

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

CVSS 3.1 · 9.8 Critical EPSS 5.7% KEV · Not listed
Vendors
Debian Gnu Oracle and 1 more
Products
Debian Linux Glibc Communications Cloud Native Core Unified Data Repository and 2 more
CVE-2022-22576

curl: OAUTH2 bearer bypass in connection re-use

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

CVSS 3.1 · 8.1 High EPSS 2.5% KEV · Not listed
Vendors
Broadcom Debian Haxx and 3 more
Products
Fabric Operating System Debian Linux Curl and 15 more
CVE-2022-21505

kernel: lockdown bypass using IMA

In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle Redhat
Products
Linux Enterprise Linux
CVE-2022-21166

hw: cpu: incomplete clean-up in specific special register write operations (aka DRPW)

Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS 3.1 · 5.5 Medium EPSS 6.5% KEV · Not listed
Vendors
Debian Fedoraproject Intel and 3 more
Products
Debian Linux Fedora Sgx Dcap and 11 more
CVE-2022-21125

hw: cpu: incomplete clean-up of microarchitectural fill buffers (aka SBDS)

Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS 3.1 · 5.5 Medium EPSS 6.5% KEV · Not listed
Vendors
Debian Fedoraproject Intel and 3 more
Products
Debian Linux Fedora Sgx Dcap and 11 more
CVE-2022-21123

hw: cpu: incomplete clean-up of multi-core shared buffers (aka SBDR)

Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVSS 3.1 · 5.5 Medium EPSS 6.9% KEV · Not listed
Vendors
Debian Fedoraproject Intel and 3 more
Products
Debian Linux Fedora Sgx Dcap and 11 more
CVE-2022-20572

kernel: missing DM_TARGET_IMMUTABLE feature flag in verity_target in drivers/md/dm-verity-target.c

In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Android Enterprise Linux
CVE-2022-4662

kernel: Recursive locking violation in usb-storage that can cause the kernel to deadlock

A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux
CVE-2022-4450

Double free after calling PEM_read_bio_ex

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue.

CVSS 3.1 · 7.5 High EPSS 28.6% KEV · Not listed
Vendors
Openssl Redhat Stormshield
Products
Openssl Enterprise Linux Jboss Core Services and 3 more
CVE-2022-4304

Timing Oracle in RSA Decryption

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.

CVSS 3.1 · 5.9 Medium EPSS 23.5% KEV · Not listed
Vendors
Openssl Redhat Stormshield
Products
Openssl Enterprise Linux Jboss Core Services and 5 more
CVE-2022-4269

kernel: net: CPU soft lockup in TC mirred egress-to-ingress action

A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus and 1 more