Export limit exceeded: 425824 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 626

Export CSV
CVE-2020-14372

grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled

A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability is to data confidentiality and integrity, as well as system availability.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Fedoraproject Gnu Netapp and 1 more
Products
Fedora Grub2 Cloud Backup and 10 more
CVE-2019-8308

flatpak: potential /proc based sandbox escape

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.

CVSS 3.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Debian Flatpak Redhat
Products
Debian Linux Flatpak Enterprise Linux and 6 more
CVE-2019-6454

systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

CVSS 3.1 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 5 more
Products
Ubuntu Linux Debian Linux Fedora and 23 more
CVE-2019-6133

polkit: Temporary auth hijacking via PID reuse and non-atomic fork

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

CVSS 3.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Polkit Project and 1 more
Products
Ubuntu Linux Debian Linux Polkit and 9 more
CVE-2019-6116

ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317)

In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.

CVSS 3.1 · 7.8 High EPSS 41.6% KEV · Not listed
Vendors
Artifex Canonical Debian and 3 more
Products
Ghostscript Ubuntu Linux Debian Linux and 9 more
CVE-2019-3878

mod_auth_mellon: authentication bypass in ECP flow

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

CVSS 3.0 · 8.1 High EPSS 3.0% KEV · Not listed
Vendors
Canonical Fedoraproject Mod Auth Mellon Project and 1 more
Products
Ubuntu Linux Fedora Mod Auth Mellon and 8 more
CVE-2019-3838

ghostscript: forceput in DefineResource is still accessible (700576)

It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 9 more
CVE-2019-3835

ghostscript: superexec operator is available (700585)

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.

CVSS 3.1 · 5.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 9 more
CVE-2019-3816

openwsman: Disclosure of arbitrary files outside of the registered URIs

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

CVSS 3.1 · 7.5 High EPSS 14.7% KEV · Not listed
Vendors
Fedoraproject Opensuse Openwsman Project and 1 more
Products
Fedora Leap Openwsman and 8 more
CVE-2019-3815

systemd: memory leak in journald-server.c introduced by fix for CVE-2018-16864

A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Enterprise Linux Enterprise Linux Desktop and 5 more
CVE-2019-3813

spice: Off-by-one error in array access in spice/server/memslot.c

Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 7 more
CVE-2019-2422

OpenJDK: memory disclosure in FileChannelImpl (Libraries, 8206290)

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1; Java SE Embedded: 8u191. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).

CVSS 3.1 · 3.1 Low EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Hp and 4 more
Products
Ubuntu Linux Debian Linux Xp7 Command View and 17 more
CVE-2019-14813

ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)

A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.

CVSS 3.1 · 9.8 Critical EPSS 11.0% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 2 more
Products
Ghostscript Debian Linux Fedora and 10 more
CVE-2019-10216

ghostscript: -dSAFER escape via .buildfont1 (701394)

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

CVSS 3.1 · 7.8 High EPSS 2.3% KEV · Not listed
Vendors
Artifex Redhat
Products
Ghostscript 3scale Amp 3scale Api Management and 7 more
CVE-2019-10182

icedtea-web: path traversal while processing <jar/> elements of JNLP files results in arbitrary file overwrite

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user.

CVSS 3.0 · 8.2 High EPSS 2.7% KEV · Not listed
Vendors
Icedtea-web Project Redhat
Products
Icedtea-web Enterprise Linux Enterprise Linux Desktop and 4 more
CVE-2019-10171

389-ds-base: Insufficient fix for CVE-2018-14648 denial of service in RHEL-7.5

It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be able to provoke excessive CPU consumption leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
389 Directory Server Enterprise Linux Server Eus Rhel Eus
CVE-2019-10168

libvirt: arbitrary command execution via virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU APIs

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Virtualization Enterprise Linux Enterprise Linux Desktop and 7 more
CVE-2019-10167

libvirt: arbitrary command execution via virConnectGetDomainCapabilities API

The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Virtualization Enterprise Linux Enterprise Linux Desktop and 7 more