Filtered by vendor Redislabs
Subscriptions
Total
26 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-47003 | 1 Redislabs | 1 Redisgraph | 2024-08-14 | 9.8 Critical |
| An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlock_ItemIsDeleted. | ||||
| CVE-2013-7458 | 2 Debian, Redislabs | 2 Debian Linux, Redis | 2024-08-06 | N/A |
| linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file. | ||||
| CVE-2013-0178 | 1 Redislabs | 1 Redis | 2024-08-06 | 5.5 Medium |
| Insecure temporary file vulnerability in Redis before 2.6 related to /tmp/redis-%p.vm. | ||||
| CVE-2013-0180 | 1 Redislabs | 1 Redis | 2024-08-06 | 5.5 Medium |
| Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds. | ||||
| CVE-2015-8080 | 4 Debian, Opensuse, Redhat and 1 more | 6 Debian Linux, Leap, Opensuse and 3 more | 2024-08-06 | 7.5 High |
| Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. | ||||
| CVE-2015-4335 | 3 Debian, Redhat, Redislabs | 3 Debian Linux, Openstack, Redis | 2024-08-06 | N/A |
| Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command. | ||||
| CVE-2016-10517 | 1 Redislabs | 1 Redis | 2024-08-06 | N/A |
| networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port). | ||||
| CVE-2016-8339 | 1 Redislabs | 1 Redis | 2024-08-06 | 9.8 Critical |
| A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution. | ||||
| CVE-2017-15047 | 1 Redislabs | 1 Redis | 2024-08-05 | N/A |
| The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) or possibly have unspecified other impact by leveraging "limited access to the machine." | ||||
| CVE-2018-12453 | 1 Redislabs | 1 Redis | 2024-08-05 | N/A |
| Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream. | ||||
| CVE-2018-12326 | 2 Redhat, Redislabs | 3 Openstack, Rhel Software Collections, Redis | 2024-08-05 | N/A |
| Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line. NOTE: It is unclear whether there are any common situations in which redis-cli is used with, for example, a -h (aka hostname) argument from an untrusted source. | ||||
| CVE-2018-11219 | 4 Debian, Oracle, Redhat and 1 more | 5 Debian Linux, Communications Operations Monitor, Openstack and 2 more | 2024-08-05 | N/A |
| An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking. | ||||
| CVE-2018-11218 | 4 Debian, Oracle, Redhat and 1 more | 5 Debian Linux, Communications Operations Monitor, Openstack and 2 more | 2024-08-05 | N/A |
| Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows. | ||||
| CVE-2019-10192 | 5 Canonical, Debian, Oracle and 2 more | 12 Ubuntu Linux, Debian Linux, Communications Operations Monitor and 9 more | 2024-08-04 | 7.2 High |
| A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer. | ||||
| CVE-2019-10193 | 5 Canonical, Debian, Oracle and 2 more | 10 Ubuntu Linux, Debian Linux, Communications Operations Monitor and 7 more | 2024-08-04 | 7.2 High |
| A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By corrupting a hyperloglog using the SETRANGE command, an attacker could cause Redis to perform controlled increments of up to 12 bytes past the end of a stack-allocated buffer. | ||||
| CVE-2020-35668 | 2 Redhat, Redislabs | 2 Acm, Redisgraph | 2024-08-04 | 7.5 High |
| RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference that leads to a server crash because it mishandles an unquoted string, such as an alias that has not yet been introduced. | ||||
| CVE-2020-21468 | 1 Redislabs | 1 Redis | 2024-08-04 | 7.5 High |
| A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS). NOTE: the vendor cannot reproduce this issue in a released version, such as 5.0.7 | ||||
| CVE-2020-14147 | 4 Debian, Oracle, Redislabs and 1 more | 4 Debian Linux, Communications Operations Monitor, Redis and 1 more | 2024-08-04 | 7.7 High |
| An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow. NOTE: this issue exists because of a CVE-2015-8080 regression. | ||||
| CVE-2020-7105 | 3 Debian, Fedoraproject, Redislabs | 3 Debian Linux, Fedora, Hiredis | 2024-08-04 | 7.5 High |
| async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked. | ||||
| CVE-2021-32761 | 3 Debian, Fedoraproject, Redislabs | 3 Debian Linux, Fedora, Redis | 2024-08-03 | 7.5 High |
| Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15, and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to a very large value and constructing specially crafted commands bit commands. This problem only affects Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5 contain patches for this issue. An additional workaround to mitigate the problem without patching the `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command. | ||||