Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,250

Export CSV
CVE-2022-2586

kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.

CVSS 3.1 · 5.3 Medium EPSS 10.2% KEV · Listed
Vendors
Canonical Linux Redhat and 2 more
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 12 more
CVE-2022-41674

kernel: u8 overflow problem in cfg80211_update_notlisted_nontrans()

An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.

CVSS 3.1 · 8.1 High EPSS 4.1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 3 more
CVE-2022-41218

kernel: Report vmalloc UAF in dvb-core/dmxdev

In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 2 more
CVE-2022-40304

libxml2: dict corruption caused by entity reference cycles

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

CVSS 3.1 · 7.8 High EPSS 5.8% KEV · Not listed
Vendors
Apple Netapp Redhat and 1 more
Products
Ipados Iphone Os Macos and 22 more
CVE-2022-40303

libxml2: integer overflows with XML_PARSE_HUGE

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

CVSS 3.1 · 7.5 High EPSS 41.4% KEV · Not listed
Vendors
Apple Netapp Redhat and 1 more
Products
Ipados Iphone Os Macos and 22 more
CVE-2022-39188

kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry

An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 2 more
CVE-2022-36946

kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.

CVSS 3.1 · 7.5 High EPSS 8.9% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel Active Iq Unified Manager and 7 more
CVE-2022-36879

kernel: xfrm_expand_policies() in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice

An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel A700s and 43 more
CVE-2022-35252

curl: Incorrect handling of control code characters in cookies

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

CVSS 3.1 · 3.7 Low EPSS 3.8% KEV · Not listed
Vendors
Apple Debian Haxx and 3 more
Products
Macos Debian Linux Curl and 18 more
CVE-2022-32250

kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.

CVSS 3.1 · 7.8 High EPSS 2.9% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 17 more
CVE-2022-32221

curl: POST following PUT confusion

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST.

CVSS 3.1 · 9.8 Critical EPSS 5.1% KEV · Not listed
Vendors
Apple Debian Haxx and 3 more
Products
Macos Debian Linux Curl and 13 more
CVE-2022-26373

hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions

Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Intel Redhat
Products
Debian Linux Celeron 5305u Celeron 5305u Firmware and 984 more
CVE-2022-25236

expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

CVSS 3.1 · 9.8 Critical EPSS 35.3% KEV · Not listed
Vendors
Debian Libexpat Project Oracle and 2 more
Products
Debian Linux Libexpat Http Server and 8 more
CVE-2022-25235

expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

CVSS 3.1 · 9.8 Critical EPSS 5.0% KEV · Not listed
Vendors
Debian Fedoraproject Libexpat Project and 3 more
Products
Debian Linux Fedora Libexpat and 9 more
CVE-2022-24407

cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

CVSS 3.1 · 8.8 High EPSS 4.1% KEV · Not listed
Vendors
Cyrusimap Debian Fedoraproject and 3 more
Products
Cyrus-sasl Debian Linux Fedora and 11 more