Filtered by vendor Redhat Subscriptions
Total 21359 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-0326 4 Debian, Fedoraproject, Google and 1 more 4 Debian Linux, Fedora, Android and 1 more 2024-08-03 7.5 High
In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525
CVE-2021-0308 3 Debian, Google, Redhat 4 Debian Linux, Android, Enterprise Linux and 1 more 2024-08-03 6.8 Medium
In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11, Android-8.0; Android ID: A-158063095.
CVE-2021-0129 4 Bluez, Debian, Linux and 1 more 4 Bluez, Debian Linux, Linux Kernel and 1 more 2024-08-03 5.7 Medium
Improper access control in BlueZ may allow an authenticated user to potentially enable information disclosure via adjacent access.
CVE-2022-48624 1 Redhat 3 Enterprise Linux, Logging, Rhel Eus 2024-08-03 7.0 High
close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.
CVE-2022-48554 3 Debian, File Project, Redhat 3 Debian Linux, File, Enterprise Linux 2024-08-03 5.5 Medium
File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.
CVE-2022-48468 2 Protobuf-c Project, Redhat 3 Protobuf-c, Enterprise Linux, Rhel Eus 2024-08-03 5.5 Medium
protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
CVE-2022-48560 3 Debian, Python, Redhat 4 Debian Linux, Python, Enterprise Linux and 1 more 2024-08-03 7.5 High
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
CVE-2022-48564 3 Netapp, Python, Redhat 4 Active Iq Unified Manager, Python, Enterprise Linux and 1 more 2024-08-03 6.5 Medium
read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
CVE-2022-48337 3 Debian, Gnu, Redhat 4 Debian Linux, Emacs, Enterprise Linux and 1 more 2024-08-03 9.8 Critical
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.
CVE-2022-48339 2 Gnu, Redhat 3 Emacs, Enterprise Linux, Rhel Eus 2024-08-03 7.8 High
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.
CVE-2022-48338 2 Gnu, Redhat 2 Emacs, Enterprise Linux 2024-08-03 7.3 High
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.
CVE-2022-48281 3 Debian, Libtiff, Redhat 3 Debian Linux, Libtiff, Enterprise Linux 2024-08-03 5.5 Medium
processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image.
CVE-2022-48303 3 Fedoraproject, Gnu, Redhat 4 Fedora, Tar, Enterprise Linux and 1 more 2024-08-03 5.5 Medium
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.
CVE-2022-48279 3 Debian, Redhat, Trustwave 3 Debian Linux, Jboss Core Services, Modsecurity 2024-08-03 7.5 High
In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.
CVE-2022-48285 2 Jszip Project, Redhat 2 Jszip, Rhmt 2024-08-03 7.3 High
loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
CVE-2022-47950 3 Debian, Openstack, Redhat 3 Debian Linux, Swift, Openstack 2024-08-03 6.5 Medium
An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).
CVE-2022-47951 3 Debian, Openstack, Redhat 5 Debian Linux, Cinder, Glance and 2 more 2024-08-03 5.7 Medium
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
CVE-2022-47929 3 Debian, Linux, Redhat 5 Debian Linux, Linux Kernel, Enterprise Linux and 2 more 2024-08-03 5.5 Medium
In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft in net/sched/sch_api.c.
CVE-2022-47629 3 Debian, Gnupg, Redhat 9 Debian Linux, Libksba, Enterprise Linux and 6 more 2024-08-03 9.8 Critical
Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.
CVE-2022-47318 4 Debian, Fedoraproject, Redhat and 1 more 4 Debian Linux, Fedora, Satellite and 1 more 2024-08-03 8.0 High
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.