Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2022-42852

webkitgtk: memory disclosure issue was addressed with improved memory handling

The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may result in the disclosure of process memory.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Apple Redhat
Products
Ipados Iphone Os Macos and 5 more
CVE-2022-46700

webkitgtk: memory corruption issue leading to arbitrary code execution

A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Apple Redhat
Products
Ipados Iphone Os Macos and 5 more
CVE-2022-46699

webkitgtk: memory corruption issue leading to arbitrary code execution

A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Apple Redhat
Products
Ipados Iphone Os Macos and 5 more
CVE-2022-46698

webkitgtk: logic issue leading to user information disclosure

A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2, watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user information.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Apple Redhat
Products
Icloud Ipados Iphone Os and 6 more
CVE-2021-22569

Denial of Service of protobuf-java parsing procedure

An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Google Oracle Redhat
Products
Google-protobuf Protobuf-java Protobuf-kotlin and 11 more
CVE-2021-22570

Nullptr Dereference in Protobuf

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Protobuf and 8 more
CVE-2022-1798

Path Traversal vulnerability in Kubevirt

A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Kubevirt Redhat
Products
Kubevirt Container Native Virtualization
CVE-2022-40149

Stack Buffer Overflow in Jettison

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Jettison Project Redhat
Products
Debian Linux Jettison Amq Streams and 8 more
CVE-2022-40150

Stack Buffer Overflow in Jettison

Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Jettison Project Redhat
Products
Debian Linux Jettison Amq Streams and 8 more
CVE-2022-41853

Remote code execution in HyperSQL DataBase

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.

CVSS 3.1 · 8 High EPSS 5.1% KEV · Not listed
Vendors
Debian Hsqldb Redhat
Products
Debian Linux Hypersql Database Camel Spring Boot and 5 more
CVE-2022-3171

Memory handling vulnerability in ProtocolBuffers Java core and lite

A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Google Redhat
Products
Fedora Google-protobuf Protobuf-java and 7 more
CVE-2024-38428

wget: Misinterpretation of input may lead to improper behavior

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Gnu Redhat
Products
Wget Enterprise Linux Rhel Aus and 3 more
CVE-2016-3099

mod_nss: Invalid handling of +CIPHER operator

mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.

CVSS 3.0 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node and 2 more
CVE-2017-17558

kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow

The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.

CVSS 3.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat Suse
Products
Linux Kernel Enterprise Linux Enterprise Mrg and 3 more
CVE-2016-10002

squid: Information disclosure in HTTP request processing

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

CVSS 3.0 · 7.5 High EPSS 7.0% KEV · Not listed
Vendors
Debian Redhat Squid-cache
Products
Debian Linux Enterprise Linux Squid
CVE-2015-8898

ImageMagick: Prevent NULL pointer access in magick/constitute.c

The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image file.

CVSS 3.0 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Imagemagick Redhat
Products
Imagemagick Enterprise Linux
CVE-2017-13032

tcpdump: Buffer over-read in print-radius.c:print_attr_string() in RADIUS parser

The RADIUS parser in tcpdump before 4.9.2 has a buffer over-read in print-radius.c:print_attr_string().

CVSS 3.0 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2015-5183

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Redhat
Products
Amq Amq Broker Jboss A-mq and 3 more