CVE-2012-5597

wireshark: DoS (crash) in the ISAKMP dissector (wnpa-sec-2012-35)

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6059. Reason: This candidate is a reservation duplicate of CVE-2012-6059. Notes: All CVE users should reference CVE-2012-6059 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 2.0 · 4.3 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux

CVE-2012-5599

wireshark: DoS (infinite loop) in the WTP dissector (wnpa-sec-2012-37)

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6061. Reason: This candidate is a reservation duplicate of CVE-2012-6061. Notes: All CVE users should reference CVE-2012-6061 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 2.0 · 4.3 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux

CVE-2012-5595

wireshark: DoS (infinite loop) in the SCTP dissector (wnpa-sec-2012-33)

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6056. Reason: This candidate is a reservation duplicate of CVE-2012-6056. Notes: All CVE users should reference CVE-2012-6056 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 2.0 · 4.3 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux

CVE-2024-8391

Eclipse Vert.x gRPC server does not limit the maximum message size

In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server and io.vertx:vertx-grpc-client).  This is fixed in the 4.5.10 version.  Note this does not affect the Vert.x gRPC server based grpc-java and Netty libraries (Maven GAV: io.vertx:vertx-grpc)

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse Eclipse Foundation Redhat

Products

Vert.x Vert.x Camel Quarkus and 3 more

CVE-2024-43898

kernel: ext4: sanity check for NULL pointer after ext4_force_shutdown

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 0.0 Low EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux

CVE-2024-8387

mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2

Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 6 more

CVE-2024-8385

mozilla: WASM type confusion involving ArrayTypes

A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Enterprise Linux and 5 more

CVE-2022-48936

kernel: gso: do not skip outer ip header in case of ipip and net_failover

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 0.0 Low EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux

CVE-2024-39338

axios: axios: Server-Side Request Forgery

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

CVSS 3.1 · 4 Medium EPSS 1.2% KEV · Not listed

Vendors

Axios Redhat

Products

Axios Discovery Network Observ Optr and 5 more

CVE-2024-37353

kernel: virtio: delete vq in vp_find_vqs_msix() when request_irq() fails

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 4.4 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux

CVE-2024-42353

WebOb's location header normalization during redirect leads to open redirect

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Pylonsproject Redhat

Products

Webob Ceph Storage Openshift and 2 more

CVE-2024-7528

mozilla: Use-after-free in IndexedDB

Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 6 more

CVE-2024-7529

mozilla: Document content could partially obscure security prompts

The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 6 more

CVE-2024-7525

mozilla: Missing permission check when creating a StreamFilter

It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 6 more

CVE-2024-7522

mozilla: Out of bounds read in editor component

Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 6 more

CVE-2024-7521

mozilla: Incomplete WebAssembly exception handing

Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 6 more

CVE-2024-7519

mozilla: Out of bounds memory access in graphics shared memory handling

Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 6 more

CVE-2024-42226

kernel: usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux

CVE-2024-35918

kernel: randomize_kstack: Improve entropy diffusion

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux

CVE-2024-38391

kernel: cxl/region: Fix cxlr_pmem leaks

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 4.4 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux