Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,793

Export CSV
CVE-2022-31622

mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc

MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (pthread_create returns a nonzero value) while executing the method create_worker_threads, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mariadb Redhat
Products
Mariadb Enterprise Linux Rhel Software Collections
CVE-2022-31621

mariadb: improper locking due to unreleased lock in the ds_xbstream.cc

MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock. Note: The vendor argues this is just an improper locking bug and not a vulnerability with adverse effects.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mariadb Redhat
Products
Mariadb Enterprise Linux Rhel Eus and 1 more
CVE-2022-30522

mod_sed denial of service

If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.

CVSS 3.1 · 7.5 High EPSS 89.9% KEV · Not listed
Vendors
Apache Fedoraproject Netapp and 1 more
Products
Http Server Fedora Clustered Data Ontap and 3 more
CVE-2022-28738

Ruby: Double free in Regexp compilation

A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.

CVSS 3.1 · 9.8 Critical EPSS 3.1% KEV · Not listed
Vendors
Redhat Ruby-lang
Products
Enterprise Linux Rhel Software Collections Ruby
CVE-2022-28614

read beyond bounds via ap_rwrite()

The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.

CVSS 3.1 · 5.3 Medium EPSS 5.1% KEV · Not listed
Vendors
Apache Fedoraproject Netapp and 1 more
Products
Http Server Fedora Clustered Data Ontap and 3 more
CVE-2022-27387

mariadb: assertion failures in decimal_bin_size

MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Debian Mariadb Redhat
Products
Debian Linux Mariadb Enterprise Linux and 1 more