Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,250

Export CSV
CVE-2018-16866

systemd: out-of-bounds read when parsing a crafted syslog message

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.

CVSS 3.1 · 3.3 Low EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian Netapp and 2 more
Products
Ubuntu Linux Debian Linux Active Iq Performance Analytics Services and 23 more
CVE-2022-42012

dbus: `_dbus_marshal_byteswap` doesn't process fds in messages with "foreign" endianness correctly

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Fedoraproject Freedesktop Redhat
Products
Fedora Dbus Enterprise Linux and 1 more
CVE-2022-42011

dbus: dbus-daemon can be crashed by messages with array length inconsistent with element type

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Fedoraproject Freedesktop Redhat
Products
Fedora Dbus Enterprise Linux and 1 more
CVE-2022-42010

dbus: dbus-daemon crashes when receiving message with incorrectly nested parentheses and curly brackets

An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Freedesktop Redhat
Products
Fedora Dbus Enterprise Linux and 1 more
CVE-2024-0753

Mozilla: HSTS policy on subdomain could bypass policy of upper domain

In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Firefox Esr and 6 more
CVE-2023-2454

postgresql: schema_element defeats protective search_path changes

schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed
Vendors
Fedoraproject Postgresql Redhat
Products
Fedora Postgresql Enterprise Linux and 6 more
CVE-2024-0742

Mozilla: Failure to update user input timestamp

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Firefox Esr and 6 more
CVE-2024-0741

Mozilla: Out of bounds write in ANGLE

An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Debian Mozilla Redhat
Products
Debian Linux Firefox Firefox Esr and 6 more
CVE-2024-1085

Use-after-free in Linux kernel's netfilter: nf_tables component

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability. We recommend upgrading past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus
CVE-2024-38581

drm/amdgpu/mes: fix use-after-free issue

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: fix use-after-free issue Delete fence fallback timer to fix the ramdom use-after-free issue. v2: move to amdgpu_mes.c

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Eus
CVE-2023-32215

Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2023-32212

Mozilla: Potential spoof due to obscured address bar

An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2023-32213

Mozilla: Potential memory corruption in FileReader::DoReadData()

When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2023-32211

Mozilla: Content process crash due to invalid wasm code

A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2023-32207

Mozilla: Potential permissions request bypass via clickjacking

A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2023-32206

Mozilla: Crash in RLBox Expat driver

An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2023-32205

Mozilla: Browser prompts could have been obscured by popups

In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 5 more
CVE-2021-2341

OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host (Networking, 8258432)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).

CVSS 3.1 · 3.1 Low EPSS 4.2% KEV · Not listed
Vendors
Debian Fedoraproject Oracle and 1 more
Products
Debian Linux Fedora Graalvm and 7 more
CVE-2021-2388

OpenJDK: Incorrect comparison during range check elimination (Hotspot, 8264066)

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Debian Oracle Redhat
Products
Debian Linux Graalvm Jdk and 5 more