Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,468

Export CSV
CVE-2022-1706

ignition: configs are accessible from unprivileged containers in VMs running on VMware products

A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Ignition and 2 more
CVE-2022-1632

Openshift: ClusterIP Service TLS certificate not checked by route controller if re-encrypt Route destinationCACertificate field is explicitly set to default serviceCA

An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the default serviceCA skips internal Service TLS certificate validation. This flaw allows an attacker to exploit an invalid certificate, resulting in a loss of confidentiality.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Ansible Automation Platform Openshift Container Platform
CVE-2022-1629

Buffer Over-read in function find_next_quote in vim/vim

Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution

CVSS 3.1 · 7.8 High EPSS 1.9% KEV · Not listed
Vendors
Apple Fedoraproject Redhat and 1 more
Products
Macos Fedora Enterprise Linux and 2 more
CVE-2022-1623

libtiff: out-of-bounds read in LZWDecode

LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 1 more
Products
Debian Linux Fedora Libtiff and 1 more
CVE-2022-1622

libtiff: out-of-bounds read in LZWDecode

LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.

CVSS 3.1 · 5.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Apple Fedoraproject Libtiff and 1 more
Products
Iphone Os Macos Tvos and 4 more
CVE-2022-1621

Heap buffer overflow in vim_strncpy find_word in vim/vim

Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

CVSS 3.1 · 7.8 High EPSS 2.4% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 2 more
Products
Macos Debian Linux Fedora and 3 more
CVE-2022-1587

pcre2: Out-of-bounds read in get_recurse_data_length in pcre2_jit_compile.c

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Netapp Pcre and 1 more
Products
Fedora Active Iq Unified Manager H300s and 14 more
CVE-2022-1507

chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in hpjansson/chafa

chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in GitHub repository hpjansson/chafa prior to 1.10.2. chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Chafa Project Fedoraproject
Products
Chafa Fedora
CVE-2022-1381

global heap buffer overflow in skip_range in vim/vim

global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

CVSS 3.1 · 7.8 High EPSS 3.1% KEV · Not listed
Vendors
Apple Fedoraproject Vim
Products
Macos Fedora Vim
CVE-2022-1379

URL Restriction Bypass in plantuml/plantuml

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.

CVSS 3.1 · 9.1 Critical EPSS 1.6% KEV · Not listed
Vendors
Fedoraproject Plantuml
Products
Fedora Plantuml
CVE-2022-1355

libtiff: stack-buffer-overflow in tiffcp.c in main()

A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 2 more
Products
Debian Linux Fedora Libtiff and 2 more
CVE-2022-1328

mutt: buffer overflow in uudecoder function

Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line

CVSS 3.1 · 4.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Fedoraproject Mutt and 1 more
Products
Debian Linux Fedora Mutt and 1 more
CVE-2022-1247

kernel: A race condition bug in rose_connect()

An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many objects are using the rose_neigh. When a user wants to delete a rose_route via rose_ioctl(), the rose driver calls rose_del_node() and removes neighbours only if their “count” and “use” are zero.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux
CVE-2022-1231

XSS via Embedded SVG in SVG Diagram Format in plantuml/plantuml

XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in plugins for web based projects (like the Confluence plugin, etc. see https://plantuml.com/de/running).

CVSS 3.1 · 6.1 Medium EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Plantuml
Products
Fedora Plantuml
CVE-2022-1227

psgo: Privilege escalation in 'podman top'

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.

CVSS 3.1 · 8.8 High EPSS 4.2% KEV · Not listed
Vendors
Fedoraproject Podman Project Psgo Project and 1 more
Products
Fedora Podman Psgo and 16 more
CVE-2022-1204

kernel: Use after free in net/ax25/af_ax25.c

A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux
Products
Debian Linux Fedora Linux Kernel
CVE-2022-1160

heap buffer overflow in get_one_sourceline in vim/vim

heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.

CVSS 3.1 · 7.8 High EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Vim
Products
Fedora Vim
CVE-2022-1158

kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region

A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 5 more