Export limit exceeded: 425899 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,386

Export CSV
CVE-2022-21248

OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.1 · 3.7 Low EPSS 4.0% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 2 more
Products
Debian Linux Fedora 7-mode Transition Tool and 22 more
CVE-2022-21245

mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2022)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Fedoraproject Netapp Oracle and 1 more
Products
Fedora Active Iq Unified Manager Oncommand Insight and 5 more
CVE-2022-20796

ClamAV Truncated File Denial of Service Vulnerability Affecting Cisco Products: April 2022

On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in Clam AntiVirus (ClamAV) versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2 could allow an authenticated, local attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cisco Clamav Debian and 1 more
Products
Secure Endpoint Clamav Debian Linux and 1 more
CVE-2022-20785

ClamAV HTML Scanning Memory Leak Vulnerability Affecting Cisco Products: April 2022

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.

CVSS 3.1 · 7.5 High EPSS 7.1% KEV · Not listed
Vendors
Cisco Clamav Debian and 1 more
Products
Secure Endpoint Clamav Debian Linux and 1 more
CVE-2022-20771

ClamAV TIFF File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in the TIFF file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.

CVSS 3.1 · 7.5 High EPSS 5.9% KEV · Not listed
Vendors
Cisco Clamav Debian and 1 more
Products
Secure Endpoint Clamav Debian Linux and 1 more
CVE-2022-20770

ClamAV CHM File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.

CVSS 3.1 · 8.6 High EPSS 7.1% KEV · Not listed
Vendors
Cisco Clamav Debian and 1 more
Products
Secure Endpoint Clamav Debian Linux and 1 more
CVE-2022-1998

kernel: fanotify misuses fd_install() which could lead to use-after-free

A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Netapp and 1 more
Products
Fedora Linux Kernel H300s and 10 more
CVE-2022-1973

kernel: a double-free in ntfs3 log_replay may lead to a crash

A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal. This flaw allows a local attacker to crash the system and leads to a kernel information leak problem.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Netapp
Products
Fedora Linux Kernel H300s and 9 more
CVE-2022-1941

Out of Memory issue in ProtocolBuffers for cpp and python

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Debian Fedoraproject Google and 1 more
Products
Debian Linux Fedora Protobuf-cpp and 2 more
CVE-2022-1886

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Vim
Products
Fedora Vim
CVE-2022-1789

kernel: KVM: NULL pointer dereference in kvm_mmu_invpcid_gva

With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 4 more
CVE-2022-1720

Buffer Over-read in function grab_file_name in vim/vim

Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 1 more
Products
Macos Debian Linux Fedora and 1 more
CVE-2022-1708

cri-o: memory exhaustion on the node when access to the kube api

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Fedoraproject Kubernetes Redhat
Products
Fedora Cri-o Enterprise Linux and 2 more
CVE-2022-1706

ignition: configs are accessible from unprivileged containers in VMs running on VMware products

A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Ignition and 2 more