Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,574

Export CSV
CVE-2022-32885

webkitgtk: Memory corruption issue when processing web content

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing maliciously crafted web content may lead to arbitrary code execution

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apple Redhat
Products
Ipados Iphone Os Macos and 7 more
CVE-2023-27954

webkitgtk: Website may be able to track sensitive user information

The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4, watchOS 9.4. A website may be able to track sensitive user information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Debian Redhat
Products
Ipados Iphone Os Macos and 6 more
CVE-2024-8386

mozilla: SelectElements could be shown over another site if popups are allowed

If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Enterprise Linux and 5 more
CVE-2024-7348

PostgreSQL relation replacement during pg_dump executes arbitrary SQL

Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Enterprise Linux Rhel Aus and 4 more
CVE-2022-46705

webkitgtk: Visiting a malicious website may lead to address bar spoofing

A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, Safari 16.2. Visiting a malicious website may lead to address bar spoofing.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Redhat
Products
Ipados Iphone Os Macos and 5 more
CVE-2022-30293

webkitgtk: Heap buffer overflow in WebCore::TextureMapperLayer::setContentsLayer leading to arbitrary code execution

In WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer in WebCore/platform/graphics/texmap/TextureMapperLayer.cpp.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Debian Redhat Webkitgtk
Products
Debian Linux Enterprise Linux Rhel Els and 1 more
CVE-2022-22720

HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

CVSS 3.1 · 9.8 Critical EPSS 28.2% KEV · Not listed
Vendors
Apache Apple Debian and 3 more
Products
Http Server Mac Os X Macos and 13 more
CVE-2022-22662

webkitgtk: Cookie management issue leading to sensitive user information disclosure

A cookie management issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5. Processing maliciously crafted web content may disclose sensitive user information.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Apple Fedoraproject Redhat
Products
Mac Os X Macos Fedora and 2 more
CVE-2022-22594

webkitgtk: A malicious website may exfiltrate data cross-origin

A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be able to track sensitive user information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Redhat
Products
Ipados Iphone Os Macos and 5 more
CVE-2022-22592

webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced

A logic issue was addressed with improved state management. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Apple Redhat
Products
Ipados Iphone Macos and 5 more
CVE-2022-22590

webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Apple Redhat Webkitgtk
Products
Ipados Iphone Os Macos and 6 more
CVE-2022-22589

webkitgtk: Processing a maliciously crafted mail message may lead to running arbitrary javascript

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing a maliciously crafted mail message may lead to running arbitrary javascript.

CVSS 3.1 · 6.1 Medium EPSS 2.0% KEV · Not listed
Vendors
Apple Redhat
Products
Ipados Iphone Os Mac Os X and 6 more
CVE-2022-0108

chromium-browser: Inappropriate implementation in Navigation

Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Google Redhat
Products
Fedora Chrome Rhel Els
CVE-2021-4155

kernel: xfs: raw block device data leak in XFS_IOC_ALLOCSP IOCTL

A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Aus and 6 more
CVE-2021-45482

webkitgtk: use-after-free in WebCore::ContainerNode::firstChild

In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different vulnerability than CVE-2021-30889.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat Webkitgtk
Products
Enterprise Linux Rhel Els Webkitgtk
CVE-2021-45481

webkitgtk: Incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create

In WebKitGTK before 2.32.4, there is incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create, leading to a segmentation violation and application crash, a different vulnerability than CVE-2021-30889.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat Webkitgtk
Products
Enterprise Linux Rhel Els Webkitgtk
CVE-2021-45417

aide: heap-based buffer overflow on outputs larger than B64_BUF

AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a heap-based buffer overflow.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Advanced Intrusion Detection Environment Project Canonical Debian and 2 more
Products
Advanced Intrusion Detection Environment Ubuntu Linux Debian Linux and 8 more
CVE-2021-43527

nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

CVSS 3.1 · 9.8 Critical EPSS 17.6% KEV · Not listed
Vendors
Mozilla Netapp Oracle and 2 more
Products
Nss Nss Esr Cloud Backup and 14 more
CVE-2021-42762

webkitgtk: limited sandbox escape via VFS syscalls

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 2 more
Products
Debian Linux Fedora Rhel Els and 2 more