Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,902

Export CSV
CVE-2022-46874

Mozilla: Drag and Dropped Filenames could have been truncated to malicious extensions

A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2022-46872

Mozilla: Arbitrary file read from a compromised content process

An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Linux Mozilla Redhat
Products
Linux Kernel Firefox Firefox Esr and 6 more
CVE-2022-45420

Mozilla: Iframe contents could be rendered outside the iframe

Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2022-45418

Mozilla: Custom mouse cursor could have been drawn over browser UI

If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2022-45408

Mozilla: Fullscreen notification bypass via windowName

Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2021-3347

kernel: Use after free via PI futex state

An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel, aka CID-34b1a1ce1458.

CVSS 3.1 · 7.8 High EPSS 1.4% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 7 more
CVE-2020-2580

mysql: Server: DDL unspecified vulnerability (CPU Jan 2020)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.17 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Netapp Oracle Redhat
Products
Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 6 more
CVE-2024-43484

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

CVSS 3.1 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Apple Linux Microsoft and 1 more
Products
Macos Linux Kernel .net and 25 more
CVE-2024-43483

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Apple Linux Microsoft and 1 more
Products
Macos Linux Kernel .net and 25 more
CVE-2022-0492

kernel: cgroups v1 release_agent feature may allow privilege escalation

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

CVSS 3.1 · 7.8 High EPSS 5.5% KEV · Listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 36 more
CVE-2018-3646

Kernel: hw: cpu: L1 terminal fault (L1TF)

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis.

CVSS 3.1 · 5.6 Medium EPSS 8.1% KEV · Not listed
Vendors
Intel Redhat
Products
Core I3 Core I5 Core I7 and 13 more
CVE-2018-3639

hw: cpu: speculative store bypass

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.

CVSS 3.1 · 5.5 Medium EPSS 60.4% KEV · Not listed
Vendors
Arm Canonical Debian and 9 more
Products
Cortex-a Ubuntu Linux Debian Linux and 327 more
CVE-2018-3620

Kernel: hw: cpu: L1 terminal fault (L1TF)

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page fault and a side-channel analysis.

CVSS 3.1 · 5.6 Medium EPSS 5.6% KEV · Not listed
Vendors
Intel Redhat
Products
Core I3 Core I5 Core I7 and 13 more
CVE-2018-12130

hardware: Microarchitectural Fill Buffer Data Sampling (MFBDS)

Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf

CVSS 3.1 · 5.9 Medium EPSS 1.6% KEV · Not listed
Vendors
Fedoraproject Intel Redhat
Products
Fedora Microarchitectural Fill Buffer Data Sampling Microarchitectural Fill Buffer Data Sampling Firmware and 10 more
CVE-2018-12127

hardware: Micro-architectural Load Port Data Sampling - Information Leak (MLPDS)

Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf

CVSS 3.1 · 5.6 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Intel Redhat
Products
Fedora Microarchitectural Load Port Data Sampling Microarchitectural Load Port Data Sampling Firmware and 10 more
CVE-2018-12126

hardware: Microarchitectural Store Buffer Data Sampling (MSBDS)

Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf

CVSS 3.1 · 5.6 Medium EPSS 1.5% KEV · Not listed
Vendors
Fedoraproject Intel Redhat
Products
Fedora Microarchitectural Store Buffer Data Sampling Microarchitectural Store Buffer Data Sampling Firmware and 10 more
CVE-2020-1971

EDIPARTYNAME NULL pointer dereference

The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).

CVSS 3.1 · 5.9 Medium EPSS 7.0% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 6 more
Products
Debian Linux Fedora Active Iq Unified Manager and 52 more
CVE-2021-4104

Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

CVSS 3.1 · 7.5 High EPSS 80.6% KEV · Not listed
Vendors
Apache Fedoraproject Oracle and 1 more
Products
Log4j Fedora Advanced Supply Chain Planning and 56 more
CVE-2019-11135

hw: TSX Transaction Asynchronous Abort (TAA)

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.

CVSS 3.1 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 309 more