Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,935

Export CSV
CVE-2022-0330

kernel: possible privileges escalation due to missing TLB flush

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Netapp and 1 more
Products
Fedora Linux Kernel H300e and 49 more
CVE-2021-3672

c-ares: Missing input validation of host names may lead to domain hijacking

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

CVSS 3.1 · 5.6 Medium EPSS 2.8% KEV · Not listed
Vendors
C-ares Project Fedoraproject Nodejs and 3 more
Products
C-ares Fedora Node.js and 16 more
CVE-2021-3656

kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel 3scale Api Management and 28 more
CVE-2021-3622

hivex: stack overflow due to recursive call of _get_children()

A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cause hivex to recursively call the _get_children() function, leading to a stack overflow. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 4.3 Medium EPSS 5.0% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Enterprise Linux Workstation and 1 more
CVE-2021-20233

grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Gnu Netapp and 1 more
Products
Fedora Grub2 Ontap Select Deploy Administration Utility and 9 more
CVE-2021-20225

grub2: Heap out-of-bounds write in short form option parser

A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 6.7 Medium EPSS 1.0% KEV · Not listed
Vendors
Fedoraproject Gnu Netapp and 1 more
Products
Fedora Grub2 Ontap Select Deploy Administration Utility and 9 more
CVE-2020-8945

proglottis/gpgme: Use-after-free in GPGME bindings during container image pull

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

CVSS 3.1 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Fedoraproject Gpgme Project Redhat
Products
Fedora Gpgme Enterprise Linux and 9 more
CVE-2020-6416

chromium-browser: Insufficient data validation in streams

Insufficient data validation in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 7 more
CVE-2020-6415

chromium-browser: Inappropriate implementation in JavaScript

Inappropriate implementation in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 7 more
CVE-2020-6408

chromium-browser: Insufficient policy enforcement in CORS

Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to obtain potentially sensitive information via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 7 more
CVE-2020-6406

chromium-browser: Use after free in audio

Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Debian Fedoraproject Google and 2 more
Products
Debian Linux Fedora Chrome and 6 more
CVE-2020-6404

chromium-browser: Inappropriate implementation in Blink

Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 7 more
CVE-2020-6403

chromium-browser: Incorrect security UI in Omnibox

Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 4 more
Products
Iphone Os Debian Linux Fedora and 8 more
CVE-2020-6402

chromium-browser: Insufficient policy enforcement in downloads

Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Apple Debian Fedoraproject and 4 more
Products
Macos Debian Linux Fedora and 8 more
CVE-2020-6400

chromium-browser: Inappropriate implementation in CORS

Inappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 7 more
CVE-2020-6398

chromium-browser: Uninitialized use in PDFium

Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 7 more
CVE-2020-6397

chromium-browser: Incorrect security UI in sharing

Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 7 more
CVE-2020-6396

chromium-browser: Inappropriate implementation in Skia

Inappropriate implementation in Skia in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 7 more
CVE-2020-6394

chromium-browser: Insufficient policy enforcement in Blink

Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML page.

CVSS 3.1 · 5.4 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 7 more
CVE-2020-6393

chromium-browser: Insufficient policy enforcement in Blink

Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Chrome and 7 more