Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 49

Export CSV
CVE-2023-4911

Glibc: buffer overflow in ld.so leading to privilege escalation

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

CVSS 3.1 · 7.8 High EPSS 63.8% KEV · Listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 49 more
CVE-2023-3899

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 22 more
CVE-2023-3972

Insights-client: unsafe handling of temporary files and directories

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an attacker could then control the directory content that insights are using by putting malicious scripts into it and executing arbitrary code as root (trivially bypassing SELinux protections because insights processes are allowed to disable SELinux system-wide).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Aus Enterprise Linux Desktop and 21 more
CVE-2023-5455

Ipa: invalid csrf protection

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Freeipa Redhat
Products
Fedora Freeipa Codeready Linux Builder and 23 more
CVE-2024-0409

Xorg-x11-server: selinux context corruption

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Tigervnc and 1 more
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 10 more
CVE-2024-0408

Xorg-x11-server: selinux unlabeled glx pbuffer

A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Redhat Tigervnc and 1 more
Products
Fedora Enterprise Linux Enterprise Linux Desktop and 10 more
CVE-2023-5869

Postgresql: buffer overrun from integer overflow in array modification

A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.

CVSS 3.1 · 8.8 High EPSS 4.3% KEV · Not listed
Vendors
Postgresql Redhat
Products
Postgresql Advanced Cluster Security Codeready Linux Builder Eus and 25 more
CVE-2023-5367

Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty

A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 14 more
CVE-2017-12617

tomcat: Remote Code Execution bypass for CVE-2017-12615

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

CVSS 3.1 · 8.1 High EPSS 100.0% KEV · Listed
Vendors
Apache Canonical Debian and 3 more
Products
Tomcat Ubuntu Linux Debian Linux and 57 more
CVE-2024-1086

Use-after-free in Linux kernel's netfilter: nf_tables component

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

CVSS 3.1 · 7.8 High EPSS 28.1% KEV · Listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 32 more
CVE-2006-5170

security flaw

pam_ldap in nss_ldap on Red Hat Enterprise Linux 4, Fedora Core 3 and earlier, and possibly other distributions does not return an error condition when an LDAP directory server responds with a PasswordPolicyResponse control response, which causes the pam_authenticate function to return a success code even if authentication has failed, as originally reported for xscreensaver.

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux Fedora Core Enterprise Linux and 5 more
CVE-2007-6283

bind: /etc/rndc.key has 644 permissions by default

Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions, which allows local users to perform unauthorized named commands, such as causing a denial of service by stopping named.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Centos Fedoraproject Oracle and 1 more
Products
Centos Fedora Core Linux and 6 more
CVE-2013-1675

Mozilla: Uninitialized functions in DOMSVGZoomEvent (MFSA 2013-47)

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

CVSS 3.1 · 6.5 Medium EPSS 6.7% KEV · Listed
Vendors
Canonical Debian Mozilla and 2 more
Products
Ubuntu Linux Debian Linux Firefox and 17 more
CVE-2014-6271

bash: specially-crafted environment variables can be used to inject shell commands

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

CVSS 3.1 · 9.8 Critical EPSS 100.0% KEV · Listed
Vendors
Apple Arista Canonical and 14 more
Products
Mac Os X Eos Ubuntu Linux and 87 more
CVE-2016-3718

ImageMagick: SSRF vulnerability

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

CVSS 3.1 · 5.5 Medium EPSS 75.6% KEV · Listed
Vendors
Canonical Imagemagick Opensuse and 3 more
Products
Ubuntu Linux Imagemagick Leap and 28 more
CVE-2014-7169

bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

CVSS 3.1 · 9.8 Critical EPSS 99.9% KEV · Listed
Vendors
Apple Arista Canonical and 14 more
Products
Mac Os X Eos Ubuntu Linux and 87 more
CVE-2015-4902

JDK: unspecified vulnerability fixed in 6u105, 7u91 and 8u65 (Deployment)

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

CVSS 3.1 · 5.3 Medium EPSS 13.6% KEV · Listed
Vendors
Opensuse Oracle Redhat and 1 more
Products
Leap Opensuse Jdk and 21 more