CVE-2022-48174

busybox: stack overflow vulnerability in ash.c leads to arbitrary code execution

There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.

CVSS 3.1 · 9.8 Critical EPSS 3.2% KEV · Not listed

Vendors

Busybox Debian Redhat

Products

Busybox Debian Linux Rhel Els

CVE-2025-1080

Macro URL arbitrary script execution

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser using that scheme could be constructed with an embedded inner URL that when passed to LibreOffice could call internal macros with arbitrary arguments. This issue affects LibreOffice: from 24.8 before < 24.8.5, from 25.2 before < 25.2.1.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Debian Libreoffice Redhat

Products

Debian Linux Libreoffice Enterprise Linux and 5 more

CVE-2023-3341

A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly

The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed

Vendors

Debian Fedoraproject Isc and 1 more

Products

Debian Linux Fedora Bind and 6 more

CVE-2024-39936

qtbase: qtbase: Delay any communication until encrypted() can be responded to

An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Qt Redhat

Products

Qt Enterprise Linux Rhel Aus and 4 more

CVE-2014-1544

nss: Race-condition in certificate verification can lead to Remote code execution (MFSA 2014-63)

Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.

CVSS 2.0 · 10.0 Critical EPSS 6.1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Network Security Services and 5 more

CVE-2024-38475

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

CVSS 3.1 · 9.1 Critical EPSS 100.0% KEV · Listed

Vendors

Apache Netapp Redhat and 1 more

Products

Http Server Ontap 9 Enterprise Linux and 16 more

CVE-2021-3156

sudo: Heap buffer overflow in argument parsing

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

CVSS 3.1 · 7.8 High EPSS 100.0% KEV · Listed

Vendors

Beyondtrust Debian Fedoraproject and 6 more

Products

Privilege Management For Mac Privilege Management For Unix\/linux Debian Linux and 35 more

CVE-2020-11023

Potential XSS vulnerability in jQuery

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS 3.1 · 6.9 Medium EPSS 84.9% KEV · Listed

Vendors

Debian Drupal Fedoraproject and 5 more

Products

Debian Linux Drupal Fedora and 75 more

CVE-2021-4034

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

CVSS 3.1 · 7.8 High EPSS 94.9% KEV · Listed

Vendors

Canonical Oracle Polkit Project and 4 more

Products

Ubuntu Linux Http Server Zfs Storage Appliance Kit and 34 more

CVE-2024-36971

net: fix __dst_negative_advice() race

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.

CVSS 3.1 · 7.8 High EPSS 2.7% KEV · Listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 6 more

CVE-2023-41993

webkitgtk: processing malicious web content may lead to arbitrary code execution

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

CVSS 3.1 · 8.8 High EPSS 23.7% KEV · Listed

Vendors

Apple Debian Fedoraproject and 4 more

Products

Ipad Os Ipados Iphone Os and 14 more

CVE-2024-47176

cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source

CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.

CVSS 3.1 · 5.3 Medium EPSS 50.6% KEV · Not listed

Vendors

Openprinting Redhat

Products

Cups Cups-browsed Enterprise Linux and 5 more

CVE-2024-3651

Denial of Service via Quadratic Complexity in kjd/idna

A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Kjd Redhat

Products

Internationalized Domain Names In Applications Ansible Automation Platform Enterprise Linux and 5 more

CVE-2023-44444

GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability

GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22097.

CVSS 3.1 · 7.8 High EPSS 56.1% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Rhel Aus and 4 more

CVE-2023-44442

GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.

CVSS 3.1 · 7.8 High EPSS 61.2% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Rhel Aus and 4 more

CVE-2023-39928

webkitgtk: use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports

A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5. A specially crafted web page can abuse this vulnerability to cause memory corruption and potentially arbitrary code execution. A user would need to to visit a malicious webpage to trigger this vulnerability.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 2 more

CVE-2023-50387

bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Not listed

Vendors

Fedoraproject Isc Microsoft and 5 more

Products

Fedora Bind Windows Server 2008 and 15 more

CVE-2024-4558

chromium-browser: Use after free in ANGLE

Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Apple Fedoraproject Google and 1 more

Products

Ipados Iphone Os Macos and 9 more

CVE-2024-8384

mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions

The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could have led to memory corruption. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Enterprise Linux and 5 more

CVE-2024-8383

mozilla: Firefox did not ask before openings news: links in an external application

Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Enterprise Linux and 5 more