Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

CVE-2022-3970

LibTIFF tif_getimage.c TIFFReadRGBATileExt integer overflow

A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Apple Debian Libtiff and 2 more
Products
Ipados Iphone Os Macos and 5 more
CVE-2018-1000156

patch: Malicious patch files cause ed to execute arbitrary commands

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.

CVSS 3.0 · 7.8 High EPSS 5.3% KEV · Not listed
Vendors
Canonical Debian Gnu and 1 more
Products
Ubuntu Linux Debian Linux Patch and 11 more
CVE-2022-4515

ctags: arbitrary command execution via a tag file with a crafted filename

A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Exuberant Ctags Project Redhat
Products
Debian Linux Exuberant Ctags Enterprise Linux
CVE-2022-4130

satellite: Blind SSRF via Referer header

A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external interaction to an attacker's server by modifying the Referer header in an HTTP request of specific resources in the server.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Satellite Satellite Capsule Satellite Utils
CVE-2022-41318

squid: buffer-over-read in SSPI and SMB authentication

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7.

CVSS 3.1 · 8.6 High EPSS 3.1% KEV · Not listed
Vendors
Redhat Squid-cache
Products
Enterprise Linux Rhel E4s Rhel Eus and 1 more
CVE-2021-35065

glob-parent: Regular Expression Denial of Service

The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Gulpjs Redhat
Products
Glob-parent Enterprise Linux Logging and 5 more
CVE-2022-4172

QEMU: ACPI ERST: memory corruption issues in read_erst_record and write_erst_record

An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Qemu Redhat
Products
Fedora Qemu Enterprise Linux
CVE-2022-4147

quarkus-vertx-http: Security misconfiguration of CORS : OWASP A05_2021 level in Quarkus

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Quarkus
CVE-2022-4144

QEMU: QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read

An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Qemu Redhat
Products
Extra Packages For Enterprise Linux Fedora Qemu and 2 more
CVE-2021-38561

golang: out-of-bounds read in golang.org/x/text/language leads to DoS

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Golang Redhat
Products
Text Acm Container Native Virtualization and 3 more
CVE-2016-4581

kernel: Slave being first propagated copy causes oops in propagate_mnt

fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted series of mount system calls.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Oracle and 1 more
Products
Ubuntu Linux Linux Kernel Linux and 2 more
CVE-2015-3416

sqlite: stack buffer overflow in src/printf.c

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

CVSS 2.0 · 7.5 High EPSS 5.4% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Mac Os X Watchos Ubuntu Linux and 4 more
CVE-2016-5767

gd: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow

Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.

CVSS 3.0 · 8.8 High EPSS 6.7% KEV · Not listed
Vendors
Libgd Php Redhat
Products
Libgd Php Enterprise Linux and 1 more
CVE-2016-1627

chromium-browser: various fixes from internal audits

The Developer Tools (aka DevTools) subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted URL, related to browser/devtools/devtools_ui_bindings.cc and WebKit/Source/devtools/front_end/Runtime.js.

CVSS 3.0 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Debian Google Opensuse and 1 more
Products
Debian Linux Chrome Opensuse and 1 more
CVE-2016-1636

chromium-browser: SRI Validation Bypass

The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information about integrity-check occurrences instead of integrity-check successes, which allows remote attackers to bypass the Subresource Integrity (aka SRI) protection mechanism by triggering two loads of the same resource.

CVSS 3.0 · 9.8 Critical EPSS 1.8% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2016-1638

chromium-browser: WebAPI Bypass

extensions/renderer/resources/platform_app.js in the Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly restrict use of Web APIs, which allows remote attackers to bypass intended access restrictions via a crafted platform app.

CVSS 3.0 · 6.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras
CVE-2015-1822

chrony: uninitialized pointer in cmdmon reply slots

chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.

CVSS 2.0 · 6.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Debian Redhat Tuxfamily
Products
Debian Linux Enterprise Linux Chrony
CVE-2016-1640

chromium-browser: origin confusion in Extensions UI

The Web Store inline-installer implementation in the Extensions UI in Google Chrome before 49.0.2623.75 does not block installations upon deletion of an installation frame, which makes it easier for remote attackers to trick a user into believing that an installation request originated from the user's next navigation target via a crafted web site.

CVSS 3.0 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Google Redhat
Products
Chrome Rhel Extras