Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,536

Export CSV
CVE-2022-2873

kernel: an out-of-bounds vulnerability in i2c-ismt driver

An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 13 more
CVE-2022-2526

systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c

A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Netapp Redhat Systemd Project
Products
Active Iq Unified Manager H300s H300s Firmware and 11 more
CVE-2022-2318

Kernel: A use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c

There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp
Products
Debian Linux Linux Kernel H300s and 9 more
CVE-2022-2058

libtiff: division by zero issues in tiffcrop

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 2 more
Products
Debian Linux Fedora Libtiff and 2 more
CVE-2022-2057

libtiff: division by zero issues in tiffcrop

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 2 more
Products
Debian Linux Fedora Libtiff and 2 more
CVE-2022-2056

libtiff: division by zero issues in tiffcrop

Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Libtiff and 2 more
Products
Debian Linux Fedora Libtiff and 2 more
CVE-2022-2048

http2-server: Invalid HTTP/2 requests cause DoS

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Debian Eclipse Jenkins and 2 more
Products
Debian Linux Jetty Jenkins and 9 more
CVE-2022-2047

jetty-http: improver hostname input handling

In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.

CVSS 3.1 · 2.7 Low EPSS 1.3% KEV · Not listed
Vendors
Debian Eclipse Netapp and 1 more
Products
Debian Linux Jetty Element Plug-in For Vcenter Server and 6 more
CVE-2022-29968

kernel: io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private

An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Linux Netapp
Products
Fedora Linux Kernel H300s and 10 more
CVE-2022-29526

golang: syscall: faccessat checks wrong group

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

CVSS 3.1 · 5.3 Medium EPSS 3.0% KEV · Not listed
Vendors
Fedoraproject Golang Linux and 2 more
Products
Fedora Go Linux Kernel and 12 more
CVE-2022-29156

kernel: rtrs-clt.c rtrs_clt_dev_release double free

drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Netapp
Products
Linux Kernel H300e H300e Firmware and 14 more
CVE-2022-28893

kernel: use after free in SUNRPC subsystem

The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel H300e and 22 more
CVE-2022-28614

read beyond bounds via ap_rwrite()

The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.

CVSS 3.1 · 5.3 Medium EPSS 5.1% KEV · Not listed
Vendors
Apache Fedoraproject Netapp and 1 more
Products
Http Server Fedora Clustered Data Ontap and 3 more
CVE-2022-28131

Stack exhaustion from deeply nested XML documents in encoding/xml

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 1 more
Products
Fedora Go Cloud Insights Telegraf and 13 more
CVE-2022-27223

kernel: In drivers/usb/gadget/udc/udc-xilinx.c the endpoint index is not validated

In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access.

CVSS 3.1 · 8.8 High EPSS 2.1% KEV · Not listed
Vendors
Debian Linux Netapp
Products
Debian Linux Linux Kernel Active Iq Unified Manager and 14 more