Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,468

Export CSV
CVE-2022-24439

Remote Code Execution (RCE)

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

CVSS 3.1 · 8.1 High EPSS 6.1% KEV · Not listed
Vendors
Debian Fedoraproject Gitpython Project and 1 more
Products
Debian Linux Fedora Gitpython and 2 more
CVE-2022-24349

Reflected XSS in action configuration window of Zabbix Frontend

An authenticated user can create a link with reflected XSS payload for actions’ pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victim’s computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.

CVSS 3.1 · 4.6 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Zabbix
Products
Debian Linux Fedora Frontend
CVE-2022-23133

Stored XSS in host groups configuration window in Zabbix Frontend

An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.

CVSS 3.1 · 6.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Zabbix
Products
Fedora Zabbix
CVE-2022-23132

Incorrect permissions of [/var/run/zabbix] forces dac_override

During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Zabbix
Products
Fedora Zabbix
CVE-2022-22995

Western Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in Netatalk

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

CVSS 3.1 · 10 Critical EPSS 2.7% KEV · Not listed
Vendors
Fedoraproject Netatalk Westerndigital
Products
Fedora Netatalk My Cloud and 21 more
CVE-2021-4190

wireshark: Kafka dissector infinite loop

Large loop in the Kafka dissector in Wireshark 3.6.0 allows denial of service via packet injection or crafted capture file

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Fedoraproject Wireshark
Products
Fedora Wireshark
CVE-2021-4186

wireshark: Gryphon dissector crash

Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file

CVSS 3.1 · 6.3 Medium EPSS 2.3% KEV · Not listed
Vendors
Fedoraproject Wireshark
Products
Fedora Wireshark
CVE-2021-4184

wireshark: BitTorrent DHT dissector infinite loop

Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file

CVSS 3.1 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Debian Fedoraproject Oracle and 1 more
Products
Debian Linux Fedora Http Server and 2 more
CVE-2021-43859

Denial of Service by injecting highly recursive collections or maps in XStream

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

CVSS 3.1 · 7.5 High EPSS 7.9% KEV · Not listed
Vendors
Debian Fedoraproject Jenkins and 3 more
Products
Debian Linux Fedora Jenkins and 11 more
CVE-2021-42782

opensc: Stack buffer overflow issues in various places

Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash programs using the library.

CVSS 3.1 · 5.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Fedoraproject Opensc Project
Products
Fedora Opensc