Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17,080

Export CSV
CVE-2009-3552

GUI: Man in the middle attack possible on the GUI to Backend SSL connection

In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML browser application) to connect to the Red Hat Enterprise Virtualization Manager. An attacker on the local network could use this flaw to conduct a man-in-the-middle attack, tricking the user into thinking they are viewing the Red Hat Enterprise Virtualization Manager when the content is actually attacker-controlled, or modifying actions a user requested Red Hat Enterprise Virtualization Manager to perform.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Virtualization Manager
CVE-2008-3278

frysk: insecure relative RPATH

frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/bin/f* (e.g. fcore, fcatch, fstack, fstep, ...) shipped in the package. A local attacker can exploit this vulnerability by running arbitrary code as another user.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Frysk
CVE-2005-4890

coreutils: tty hijacking possible in "su" via TIOCSTI ioctl

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Redhat Sudo Project
Products
Debian Linux Shadow Enterprise Linux and 1 more
CVE-2023-4134

Kernel: cyttsp4_core: use-after-free in cyttsp4_watchdog_work()

A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device cleanup routine due to a possible rearming of the watchdog_timer from the workqueue. This could allow a local user to crash the system, causing a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux
CVE-2024-46952

ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling

An issue was discovered in pdf/pdf_xref.c in Artifex Ghostscript before 10.04.0. There is a buffer overflow during handling of a PDF XRef stream (related to W array values).

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Artifex Debian Redhat
Products
Ghostscript Debian Linux Enterprise Linux
CVE-2024-50219

kernel: mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2024-49993

kernel: iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2024-44952

kernel: driver core: Fix uevent_show() vs driver detach race

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2024-7518

mozilla: Fullscreen notification dialog can be obscured by document content

Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 6 more
CVE-2024-46839

kernel: workqueue: Improve scalability of workqueue watchdog touch

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2024-7526

mozilla: Uninitialized memory used by WebGL

ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 6 more
CVE-2009-0786

tcp_wrappers: hosts_ctl() does not handle hostnames specified in /etc/hosts.{allow,deny} correctly

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This was originally intended for a report about TCP Wrappers and the hosts_ctl API function, but further investigation showed that this was documented behavior by that function. Notes: Future CVE identifiers might be assigned to applications that mis-use the API in a security-relevant fashion.

CVSS 2.0 · 4.0 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2012-5600

wireshark: DoS (infinite loop) in the RTCP dissector (wnpa-sec-2012-38)

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6062. Reason: This candidate is a reservation duplicate of CVE-2012-6062. Notes: All CVE users should reference CVE-2012-6062 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 2.0 · 4.3 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2012-5598

wireshark: DoS (infinite loop) in the iSCSI dissector (wnpa-sec-2012-36)

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6060. Reason: This candidate is a reservation duplicate of CVE-2012-6060. Notes: All CVE users should reference CVE-2012-6060 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 2.0 · 4.3 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2012-5597

wireshark: DoS (crash) in the ISAKMP dissector (wnpa-sec-2012-35)

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6059. Reason: This candidate is a reservation duplicate of CVE-2012-6059. Notes: All CVE users should reference CVE-2012-6059 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 2.0 · 4.3 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2012-5599

wireshark: DoS (infinite loop) in the WTP dissector (wnpa-sec-2012-37)

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6061. Reason: This candidate is a reservation duplicate of CVE-2012-6061. Notes: All CVE users should reference CVE-2012-6061 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 2.0 · 4.3 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2012-5595

wireshark: DoS (infinite loop) in the SCTP dissector (wnpa-sec-2012-33)

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6056. Reason: This candidate is a reservation duplicate of CVE-2012-6056. Notes: All CVE users should reference CVE-2012-6056 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 2.0 · 4.3 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2024-43898

kernel: ext4: sanity check for NULL pointer after ext4_force_shutdown

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 0.0 Low EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2024-8387

mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2

Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Firefox Firefox Esr Thunderbird and 6 more