Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,030

Export CSV
CVE-2023-3899

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 22 more
CVE-2023-3972

Insights-client: unsafe handling of temporary files and directories

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an attacker could then control the directory content that insights are using by putting malicious scripts into it and executing arbitrary code as root (trivially bypassing SELinux protections because insights processes are allowed to disable SELinux system-wide).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Aus Enterprise Linux Desktop and 21 more
CVE-2023-5455

Ipa: invalid csrf protection

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Freeipa Redhat
Products
Fedora Freeipa Codeready Linux Builder and 23 more
CVE-2024-0409

Xorg-x11-server: selinux context corruption

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Tigervnc and 1 more
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 10 more
CVE-2024-0408

Xorg-x11-server: selinux unlabeled glx pbuffer

A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Tigervnc and 1 more
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 10 more
CVE-2023-6816

Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 10 more
CVE-2023-5869

Postgresql: buffer overrun from integer overflow in array modification

A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.

CVSS 3.1 · 8.8 High EPSS 4.3% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Advanced Cluster Security Codeready Linux Builder Eus and 25 more
CVE-2023-5367

Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty

A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 14 more
CVE-2017-5436

Mozilla: Out-of-bounds write with malicious font in Graphite 2 (MFSA 2017-11, MFSA 2017-12)

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Debian Mozilla Redhat and 1 more
Products
Debian Linux Firefox Thunderbird and 7 more
CVE-2018-1061

python: DOS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.

CVSS 3.0 · 6.5 Medium EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2018-11784

tomcat: Open redirect in default servlet

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

CVSS 3.0 · 4.3 Medium EPSS 97.7% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Tomcat Ubuntu Linux Debian Linux and 14 more
CVE-2018-11212

libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c

An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

CVSS 3.0 · 6.5 Medium EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Ijg and 4 more
Products
Ubuntu Linux Debian Linux Libjpeg and 13 more
CVE-2016-6794

tomcat: system property disclosure

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

CVSS 3.1 · 5.3 Medium EPSS 7.2% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Tomcat Ubuntu Linux Debian Linux and 12 more
CVE-2016-5388

Tomcat: CGI sets environmental variable based on user supplied Proxy request header

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.

CVSS 3.0 · 8.1 High EPSS 50.9% KEV · Not listed
Vendors
Apache Hp Oracle and 1 more
Products
Tomcat System Management Homepage Linux and 10 more
CVE-2016-10165

lcms2: Out-of-bounds read in Type_MLU_Read()

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

CVSS 3.1 · 7.1 High EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Littlecms and 3 more
Products
Ubuntu Linux Debian Linux Little Cms Color Engine and 20 more
CVE-2015-8126

libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

CVSS 2.0 · 7.5 High EPSS 10.3% KEV · Not listed
Vendors
Apple Canonical Debian and 6 more
Products
Mac Os X Ubuntu Linux Debian Linux and 21 more
CVE-2020-10531

ICU: Integer overflow in UnicodeString::doAppend()

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2019-19926

sqlite: error mishandling because of incomplete fix of CVE-2019-19880

multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.

CVSS 3.1 · 7.5 High EPSS 8.0% KEV · Not listed
Vendors
Debian Netapp Opensuse and 5 more
Products
Debian Linux Cloud Backup Backports Sle and 10 more
CVE-2019-19925

sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

CVSS 3.1 · 7.5 High EPSS 6.8% KEV · Not listed
Vendors
Debian Netapp Opensuse and 5 more
Products
Debian Linux Cloud Backup Backports Sle and 11 more
CVE-2019-19923

sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer dereference

flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).

CVSS 3.1 · 7.5 High EPSS 6.8% KEV · Not listed
Vendors
Debian Netapp Opensuse and 5 more
Products
Debian Linux Cloud Backup Backports Sle and 11 more