Report Name: Linux Patch Wednesday April 2024Generated: 2024-06-16 02:22:51
Product Name | Prevalence | U | C | H | M | L | A | Comment |
---|---|---|---|---|---|---|---|---|
Apache HTTP Server | 0.9 | 2 | 2 | Apache HTTP Server is a free and open-source web server that delivers web content through the internet | ||||
GitLab | 0.9 | 1 | 2 | 3 | GitLab is a DevOps software package that combines the ability to develop, secure, and operate software in a single application | |||
HTTP/2 | 0.9 | 1 | 1 | HTTP/2 is a major revision of the HTTP network protocol used by the World Wide Web | ||||
Linux Kernel | 0.9 | 19 | 15 | 34 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |||
Sudo | 0.9 | 1 | 1 | Sudo is a program for Unix-like computer operating systems that allows users to run programs with the security privileges of another user | ||||
Windows Kernel | 0.9 | 1 | 1 | Windows Kernel | ||||
Windows LDAP | 0.9 | 1 | 1 | Windows LDAP (Lightweight Directory Access Protocol) is an open and cross platform protocol used for directory services authentication | ||||
nghttp2 | 0.9 | 1 | 1 | nghttp2 is an implementation of HTTP/2 and its header compression algorithm HPACK in C | ||||
Chromium | 0.8 | 3 | 2 | 12 | 17 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | ||
ICMP | 0.8 | 1 | 1 | The Internet Control Message Protocol (ICMP) is a network layer protocol used by network devices to diagnose network communication issues | ||||
Mozilla Firefox | 0.8 | 9 | 1 | 10 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |||
Node.js | 0.8 | 1 | 1 | 3 | 5 | Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more | ||
OpenSSL | 0.8 | 1 | 1 | A software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end | ||||
PHP | 0.8 | 1 | 1 | PHP is a general-purpose scripting language geared towards web development. It was originally created by Danish-Canadian programmer Rasmus Lerdorf in 1993 and released in 1995. | ||||
RPC | 0.8 | 1 | 1 | Remote Procedure Call Runtime | ||||
Safari | 0.8 | 1 | 3 | 3 | 7 | Safari is a web browser developed by Apple. It is built into Apple's operating systems, including macOS, iOS, iPadOS and their upcoming VisionOS, and uses Apple's open-source browser engine WebKit, which was derived from KHTML. | ||
Apache Tomcat | 0.7 | 1 | 1 | 2 | Apache Tomcat is a free and open-source implementation of the Jakarta Servlet, Jakarta Expression Language, and WebSocket technologies | |||
Apache Traffic Server | 0.7 | 1 | 1 | The Apache Traffic Server is a modular, high-performance reverse proxy and forward proxy server, generally comparable to Nginx and Squid | ||||
BIND | 0.7 | 1 | 1 | BIND is a suite of software for interacting with the Domain Name System | ||||
Curl | 0.7 | 2 | 2 | Curl is a command-line tool for transferring data specified with URL syntax | ||||
MediaWiki | 0.7 | 10 | 6 | 1 | 17 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | ||
QEMU | 0.7 | 1 | 4 | 5 | QEMU is a generic and open source machine & userspace emulator and virtualizer | |||
iOS | 0.7 | 1 | 1 | iOS is an operating system developed and marketed by Apple Inc | ||||
vim | 0.7 | 1 | 1 | Vim is a free and open-source, screen-based text editor program | ||||
FreeRDP | 0.6 | 3 | 3 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license | ||||
Jenkins | 0.6 | 1 | 2 | 7 | 10 | Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. | ||
Jetty | 0.6 | 1 | 1 | Jetty is a Java based web server and servlet engine | ||||
Oracle Java SE | 0.6 | 4 | 4 | Oracle Java SE | ||||
Perl | 0.6 | 3 | 3 | 2 | 8 | Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages | ||
Python | 0.6 | 1 | 1 | 2 | Python is a high-level, general-purpose programming language | |||
Wireshark | 0.6 | 2 | 2 | 4 | Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education | |||
7-Zip | 0.5 | 1 | 1 | KeePass is a free open source password manager, which helps you to manage your passwords in a secure way | ||||
Cacti | 0.5 | 1 | 5 | 6 | Cacti is an open source operational monitoring and fault management framework | |||
Docker | 0.5 | 1 | 1 | Docker | ||||
Flask | 0.5 | 1 | 1 | Flask is a lightweight WSGI web application framework | ||||
TLS | 0.5 | 1 | 1 | 2 | TLS | |||
TRIE | 0.5 | 6 | 6 | TRIE | ||||
nginx | 0.5 | 2 | 2 | Nginx is an open-source web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache | ||||
GPAC | 0.4 | 1 | 7 | 2 | 10 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | ||
Git | 0.4 | 2 | 2 | Git | ||||
Unknown Product | 0 | 38 | 117 | 25 | 180 | Unknown Product |
Vulnerability Type | Criticality | U | C | H | M | L | A |
---|---|---|---|---|---|---|---|
Remote Code Execution | 1.0 | 3 | 9 | 67 | 79 | ||
Authentication Bypass | 0.98 | 1 | 1 | 4 | 2 | 8 | |
Code Injection | 0.97 | 2 | 2 | 4 | |||
Command Injection | 0.97 | 1 | 1 | 7 | 9 | ||
Security Feature Bypass | 0.9 | 3 | 6 | 15 | 24 | ||
Elevation of Privilege | 0.85 | 1 | 2 | 3 | |||
Arbitrary File Reading | 0.83 | 1 | 1 | ||||
Information Disclosure | 0.83 | 2 | 4 | 1 | 7 | ||
Cross Site Scripting | 0.8 | 14 | 8 | 22 | |||
Open Redirect | 0.75 | 1 | 1 | 2 | |||
Denial of Service | 0.7 | 4 | 18 | 29 | 3 | 54 | |
Path Traversal | 0.7 | 2 | 1 | 7 | 10 | ||
Incorrect Calculation | 0.5 | 3 | 11 | 14 | |||
Memory Corruption | 0.5 | 17 | 45 | 5 | 67 | ||
Spoofing | 0.4 | 1 | 1 | ||||
Unknown Vulnerability Type | 0 | 12 | 43 | 55 |
Source | U | C | H | M | L | A |
---|---|---|---|---|---|---|
almalinux | 2 | 3 | 32 | 16 | 53 | |
debian | 11 | 50 | 167 | 43 | 271 | |
oraclelinux | 2 | 3 | 38 | 17 | 60 | |
redhat | 2 | 3 | 37 | 20 | 62 | |
redos | 1 | 10 | 67 | 86 | 16 | 180 |
ubuntu | 2 | 3 | 43 | 30 | 78 |
1. Authentication Bypass - Jenkins (CVE-2024-23897) - Urgent [929]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
redos: CVE-2024-23897 was patched at 2024-04-11
2. Remote Code Execution - Safari (CVE-2023-42950) - Critical [746]
Description: A use after free issue was addressed with improved memory management. This issue is fixed in
Component | Value | Weight | Comment |
---|---|---|---|
1.0 | 18 | Exploitation in the wild is mentioned on BDU website | |
0.5 | 17 | The existence of a private exploit is mentioned on BDU:PrivateExploit website | |
1.0 | 15 | Remote Code Execution | |
0.8 | 14 | Safari is a web browser developed by Apple. It is built into Apple's operating systems, including macOS, iOS, iPadOS and their upcoming VisionOS, and uses Apple's open-source browser engine WebKit, which was derived from KHTML. | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2023-42950 was patched at 2024-05-09, 2024-05-15
ubuntu: CVE-2023-42950 was patched at 2024-04-15
3. Security Feature Bypass - Chromium (CVE-2024-2630) - Critical [704]
Description: Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker
Component | Value | Weight | Comment |
---|---|---|---|
1.0 | 18 | Exploitation in the wild is mentioned on BDU website | |
0.5 | 17 | The existence of a private exploit is mentioned on BDU:PrivateExploit website | |
0.9 | 15 | Security Feature Bypass | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.7 | 10 | CVSS Base Score is 6.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-2630 was patched at 2024-03-28, 2024-05-15
redos: CVE-2024-2630 was patched at 2024-05-03
4. Denial of Service - nghttp2 (CVE-2024-27316) - Critical [703]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
1.0 | 18 | Exploitation in the wild is mentioned on BDU website | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([githubexploit] Exploit for CVE-2024-27316) | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | nghttp2 is an implementation of HTTP/2 and its header compression algorithm HPACK in C | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
almalinux: CVE-2024-27316 was patched at 2024-04-11, 2024-04-18, 2024-04-30
debian: CVE-2024-27316 was patched at 2024-04-16, 2024-05-15
oraclelinux: CVE-2024-27316 was patched at 2024-04-11, 2024-04-18, 2024-05-07
redhat: CVE-2024-27316 was patched at 2024-04-11, 2024-04-18, 2024-04-30, 2024-05-16, 2024-05-20, 2024-05-28
redos: CVE-2024-27316 was patched at 2024-04-25
ubuntu: CVE-2024-27316 was patched at 2024-04-11, 2024-04-17, 2024-04-29
5. Path Traversal - Node.js (CVE-2024-21891) - Critical [680]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
1.0 | 18 | Exploitation in the wild is mentioned on BDU website | |
0.5 | 17 | The existence of a private exploit is mentioned on BDU:PrivateExploit website | |
0.7 | 15 | Path Traversal | |
0.8 | 14 | Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more | |
0.8 | 10 | CVSS Base Score is 7.9. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
almalinux: CVE-2024-21891 was patched at 2024-04-08
oraclelinux: CVE-2024-21891 was patched at 2024-04-08
redhat: CVE-2024-21891 was patched at 2024-04-08
6. Security Feature Bypass - Chromium (CVE-2024-2628) - Critical [669]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Inappropriate implementation in Downloads in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted URL. (Chromium security severity: Medium)', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
1.0 | 18 | Exploitation in the wild is mentioned on BDU website | |
0.5 | 17 | The existence of a private exploit is mentioned on BDU:PrivateExploit website | |
0.9 | 15 | Security Feature Bypass | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.4 | 10 | CVSS Base Score is 4.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-2628 was patched at 2024-03-28, 2024-05-15
redos: CVE-2024-2628 was patched at 2024-05-03
7. Authentication Bypass - PHP (CVE-2023-4448) - Critical [665]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 4dff387283060961c362d50105ff8da8ea40bcbe. It is recommended to apply a patch to fix this issue. The identifier VDB-237569 was assigned to this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.98 | 15 | Authentication Bypass | |
0.8 | 14 | PHP is a general-purpose scripting language geared towards web development. It was originally created by Danish-Canadian programmer Rasmus Lerdorf in 1993 and released in 1995. | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00063, EPSS Percentile is 0.25712 |
redos: CVE-2023-4448 was patched at 2024-03-29
8. Denial of Service - Jetty (CVE-2024-22201) - Critical [659]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.\n\n', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
1.0 | 18 | Exploitation in the wild is mentioned on BDU website | |
0.5 | 17 | The existence of a private exploit is mentioned on BDU:PrivateExploit website | |
0.7 | 15 | Denial of Service | |
0.6 | 14 | Jetty is a Java based web server and servlet engine | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.15491 |
debian: CVE-2024-22201 was patched at 2024-04-17, 2024-05-15
redos: CVE-2024-22201 was patched at 2024-04-22
9. Command Injection - BIND (CVE-2023-48306) - Critical [647]
Description: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Enterprise Server, the DNS pin middleware was vulnerable to DNS re
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.97 | 15 | Command Injection | |
0.7 | 14 | BIND is a suite of software for interacting with the Domain Name System | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00068, EPSS Percentile is 0.2868 |
redos: CVE-2023-48306 was patched at 2024-04-02
10. Remote Code Execution - Cacti (CVE-2023-49085) - Critical [630]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
1.0 | 15 | Remote Code Execution | |
0.5 | 14 | Cacti is an open source operational monitoring and fault management framework | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.5 | 10 | EPSS Probability is 0.0012, EPSS Percentile is 0.45688 |
debian: CVE-2023-49085 was patched at 2024-03-24, 2024-05-15
11. Path Traversal - Python (CVE-2022-44900) - Critical [629]
Description: A
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([packetstorm] py7zr 0.20.0 Directory Traversal, [zdt] py7zr 0.20.0 Directory Traversal Vulnerability, [githubexploit] Exploit for Path Traversal in Py7Zr Project Py7Zr) | |
0.7 | 15 | Path Traversal | |
0.6 | 14 | Python is a high-level, general-purpose programming language | |
0.9 | 10 | CVSS Base Score is 9.1. According to Vulners data source | |
0.8 | 10 | EPSS Probability is 0.00755, EPSS Percentile is 0.80798 |
debian: CVE-2022-44900 was patched at 2024-04-02, 2024-05-15
12. Remote Code Execution - GPAC (CVE-2023-46932) - Critical [626]
Description: Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
1.0 | 15 | Remote Code Execution | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.5 | 10 | EPSS Probability is 0.00118, EPSS Percentile is 0.45365 |
debian: CVE-2023-46932 was patched at 2024-05-15
redos: CVE-2023-46932 was patched at 2024-04-08
13. Security Feature Bypass - Chromium (CVE-2024-3156) - Critical [621]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
1.0 | 18 | Exploitation in the wild is mentioned on BDU website | |
0.5 | 17 | The existence of a private exploit is mentioned on BDU:PrivateExploit website | |
0.9 | 15 | Security Feature Bypass | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
debian: CVE-2024-3156 was patched at 2024-04-03, 2024-05-15
redos: CVE-2024-3156 was patched at 2024-05-03
14. Denial of Service - Wireshark (CVE-2021-22173) - Critical [605]
Description: Memory leak in USB HID dissector in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0.6 | 14 | Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.7 | 10 | EPSS Probability is 0.0028, EPSS Percentile is 0.68068 |
debian: CVE-2021-22173 was patched at 2024-05-15
redos: CVE-2021-22173 was patched at 2024-04-15
15. Denial of Service - Wireshark (CVE-2021-22174) - Critical [605]
Description: Crash in USB HID dissector in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0.6 | 14 | Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.7 | 10 | EPSS Probability is 0.0028, EPSS Percentile is 0.68068 |
debian: CVE-2021-22174 was patched at 2024-05-15
redos: CVE-2021-22174 was patched at 2024-04-15
16. Security Feature Bypass - vim (CVE-2023-4736) - High [598]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.9 | 15 | Security Feature Bypass | |
0.7 | 14 | Vim is a free and open-source, screen-based text editor program | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.18166 |
redos: CVE-2023-4736 was patched at 2024-03-29
17. Authentication Bypass - Unknown Product (CVE-2024-3096) - High [597]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
1.0 | 18 | Exploitation in the wild is mentioned on BDU website | |
0.5 | 17 | The existence of a private exploit is mentioned on BDU:PrivateExploit website | |
0.98 | 15 | Authentication Bypass | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 9.1. According to BDU data source | |
0 | 10 | EPSS Probability is 0, EPSS Percentile is 0 |
debian: CVE-2024-3096 was patched at 2024-04-15, 2024-05-15
ubuntu: CVE-2024-3096 was patched at 2024-04-29, 2024-05-02
18. Remote Code Execution - Cacti (CVE-2023-49084) - High [595]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
1.0 | 15 | Remote Code Execution | |
0.5 | 14 | Cacti is an open source operational monitoring and fault management framework | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00059, EPSS Percentile is 0.23824 |
debian: CVE-2023-49084 was patched at 2024-03-24, 2024-05-15
19. Remote Code Execution - Unknown Product (CVE-2023-6395) - High [583]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion and execution of Jinja2 templates, which may be included in certain configuration parameters. While the Mock documentation advises treating users added to the mock group as privileged, certain build systems invoking mock on behalf of users might inadvertently permit less privileged users to define configuration tags. These tags could then be passed as parameters to mock during execution, potentially leading to the utilization of Jinja2 templates for remote privilege escalation and the execution of arbitrary code as the root user on the build server.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.7 | 10 | EPSS Probability is 0.00431, EPSS Percentile is 0.74187 |
redos: CVE-2023-6395 was patched at 2024-04-10
20. Denial of Service - Apache Traffic Server (CVE-2024-31309) - High [569]
Description: HTTP/2 CONTINUATIONÂ
Component | Value | Weight | Comment |
---|---|---|---|
1.0 | 18 | Exploitation in the wild is mentioned on BDU website | |
0.5 | 17 | The existence of a private exploit is mentioned on BDU:PrivateExploit website | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | The Apache Traffic Server is a modular, high-performance reverse proxy and forward proxy server, generally comparable to Nginx and Squid | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14059 |
debian: CVE-2024-31309 was patched at 2024-04-14, 2024-05-15
21. Cross Site Scripting - MediaWiki (CVE-2023-51704) - High [557]
Description: An issue was discovered in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.6 | 10 | CVSS Base Score is 6.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
debian: CVE-2023-51704 was patched at 2024-05-15
redos: CVE-2023-51704 was patched at 2024-04-08
22. Cross Site Scripting - MediaWiki (CVE-2024-23173) - High [557]
Description: An issue was discovered in the Cargo extension in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.6 | 10 | CVSS Base Score is 6.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
redos: CVE-2024-23173 was patched at 2024-04-09
23. Cross Site Scripting - MediaWiki (CVE-2024-23177) - High [557]
Description: An issue was discovered in the WatchAnalytics extension in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.6 | 10 | CVSS Base Score is 6.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
redos: CVE-2024-23177 was patched at 2024-04-09
24. Cross Site Scripting - MediaWiki (CVE-2024-23179) - High [557]
Description: An issue was discovered in the GlobalBlocking extension in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.6 | 10 | CVSS Base Score is 6.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
redos: CVE-2024-23179 was patched at 2024-04-09
25. Memory Corruption - Chromium (CVE-2024-3158) - High [550]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
1.0 | 18 | Exploitation in the wild is mentioned on BDU website | |
0.5 | 17 | The existence of a private exploit is mentioned on BDU:PrivateExploit website | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
debian: CVE-2024-3158 was patched at 2024-04-03, 2024-05-15
redos: CVE-2024-3158 was patched at 2024-05-03
26. Memory Corruption - Chromium (CVE-2024-3159) - High [550]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
1.0 | 18 | Exploitation in the wild is mentioned on BDU website | |
0.5 | 17 | The existence of a private exploit is mentioned on BDU:PrivateExploit website | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.14657 |
debian: CVE-2024-3159 was patched at 2024-04-03, 2024-05-15
redos: CVE-2024-3159 was patched at 2024-05-03
27. Elevation of Privilege - Perl (CVE-2023-0507) - High [549]
Description: Grafana is an open-source platform for monitoring and observability.
Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap.
The stored XSS vulnerability was possible due to map attributions weren't pro
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.85 | 15 | Elevation of Privilege | |
0.6 | 14 | Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00067, EPSS Percentile is 0.28348 |
redos: CVE-2023-0507 was patched at 2024-04-03
28. Remote Code Execution - Unknown Product (CVE-2023-48106) - High [547]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_resolve function in the mz_os.c file.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.5 | 10 | EPSS Probability is 0.00118, EPSS Percentile is 0.45365 |
redos: CVE-2023-48106 was patched at 2024-03-28
29. Incorrect Calculation - FreeRDP (CVE-2023-40574) - High [546]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Incorrect Calculation | |
0.6 | 14 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00066, EPSS Percentile is 0.28126 |
redos: CVE-2023-40574 was patched at 2024-03-28
30. Memory Corruption - FreeRDP (CVE-2023-40187) - High [546]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of the 3.x beta branch are subject to a Use-After-Free issue in the `avc420_ensure_buffer` and `avc444_ensure_buffer` functions. If the value of `piDstSize[x]` is 0, `ppYUVDstData[x]` will be freed. However, in this case `ppYUVDstData[x]` will not have been updated which leads to a Use-After-Free vulnerability. This issue has been addressed in version 3.0.0-beta3. Users of the 3.x beta releases are advised to upgrade. There are no known workarounds for this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0.6 | 14 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00068, EPSS Percentile is 0.2868 |
redos: CVE-2023-40187 was patched at 2024-03-28
31. Security Feature Bypass - Unknown Product (CVE-2024-24747) - High [541]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for `s3:*` actions, but also `admin:*` actions. Which means unless somewhere above in the access-key hierarchy, the `admin` rights are denied, access keys will be able to simply override their own `s3` permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.6 | 10 | EPSS Probability is 0.00209, EPSS Percentile is 0.58544 |
redos: CVE-2024-24747 was patched at 2024-04-10
32. Cross Site Scripting - Perl (CVE-2023-1410) - High [540]
Description: Grafana is an open-source platform for monitoring and observability.Â
Grafana had a stored
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.6 | 14 | Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages | |
0.5 | 10 | CVSS Base Score is 4.8. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00062, EPSS Percentile is 0.25536 |
redos: CVE-2023-1410 was patched at 2024-04-03
33. Denial of Service - MediaWiki (CVE-2023-45367) - High [539]
Description: An issue was discovered in the CheckUser extension for
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.7 | 10 | CVSS Base Score is 6.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.12305 |
redos: CVE-2023-45367 was patched at 2024-04-05
34. Remote Code Execution - Unknown Product (CVE-2023-48107) - High [535]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_has_slash function in the mz_os.c file.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00093, EPSS Percentile is 0.39012 |
redos: CVE-2023-48107 was patched at 2024-03-28
35. Memory Corruption - FreeRDP (CVE-2023-40575) - High [534]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0.6 | 14 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license | |
0.9 | 10 | CVSS Base Score is 9.1. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00065, EPSS Percentile is 0.27682 |
redos: CVE-2023-40575 was patched at 2024-03-28
36. Cross Site Scripting - MediaWiki (CVE-2024-23171) - High [533]
Description: An issue was discovered in the CampaignEvents extension in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.13053 |
redos: CVE-2024-23171 was patched at 2024-04-09
37. Cross Site Scripting - MediaWiki (CVE-2024-23172) - High [533]
Description: An issue was discovered in the CheckUser extension in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.13053 |
redos: CVE-2024-23172 was patched at 2024-04-09
38. Cross Site Scripting - MediaWiki (CVE-2024-23174) - High [533]
Description: An issue was discovered in the PageTriage extension in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.13053 |
redos: CVE-2024-23174 was patched at 2024-04-09
39. Cross Site Scripting - MediaWiki (CVE-2024-23178) - High [533]
Description: An issue was discovered in the Phonos extension in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.13053 |
redos: CVE-2024-23178 was patched at 2024-04-09
40. Denial of Service - Unknown Product (CVE-2020-7753) - High [529]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.9 | 10 | EPSS Probability is 0.01236, EPSS Percentile is 0.85262 |
redos: CVE-2020-7753 was patched at 2024-04-03
41. Open Redirect - Flask (CVE-2023-49438) - High [526]
Description: An
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.75 | 15 | Open Redirect | |
0.5 | 14 | Flask is a lightweight WSGI web application framework | |
0.6 | 10 | CVSS Base Score is 6.1. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00063, EPSS Percentile is 0.25643 |
redos: CVE-2023-49438 was patched at 2024-04-08
42. Cross Site Scripting - Cacti (CVE-2023-39360) - High [523]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.5 | 14 | Cacti is an open source operational monitoring and fault management framework | |
0.6 | 10 | CVSS Base Score is 6.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00051, EPSS Percentile is 0.18552 |
debian: CVE-2023-39360 was patched at 2024-03-24, 2024-05-15
43. Cross Site Scripting - Cacti (CVE-2023-39513) - High [523]
Description: Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.5 | 14 | Cacti is an open source operational monitoring and fault management framework | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00083, EPSS Percentile is 0.34628 |
debian: CVE-2023-39513 was patched at 2024-03-24, 2024-05-15
44. Cross Site Scripting - Cacti (CVE-2023-49088) - High [523]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://<HOST>/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.5 | 14 | Cacti is an open source operational monitoring and fault management framework | |
0.5 | 10 | CVSS Base Score is 4.8. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00082, EPSS Percentile is 0.34278 |
debian: CVE-2023-49088 was patched at 2024-03-24, 2024-05-15
45. Cross Site Scripting - Cacti (CVE-2023-49086) - High [511]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0.5 | 14 | Cacti is an open source operational monitoring and fault management framework | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00049, EPSS Percentile is 0.16728 |
debian: CVE-2023-49086 was patched at 2024-03-24, 2024-05-15
46. Remote Code Execution - Unknown Product (CVE-2023-43361) - High [511]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00071, EPSS Percentile is 0.29593 |
almalinux: CVE-2023-43361 was patched at 2024-05-22
debian: CVE-2023-43361 was patched at 2024-05-15
oraclelinux: CVE-2023-43361 was patched at 2024-05-23
redhat: CVE-2023-43361 was patched at 2024-05-22
redos: CVE-2023-43361 was patched at 2024-04-04
47. Command Injection - Unknown Product (CVE-2023-26156) - High [506]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system.\r\r**Note:**\r\rAn attacker must have access to the system running the vulnerable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of the process running chromedriver.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.97 | 15 | Command Injection | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00067, EPSS Percentile is 0.28382 |
redos: CVE-2023-26156 was patched at 2024-03-29
48. Information Disclosure - Unknown Product (CVE-2022-23498) - High [505]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4.\n', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.83 | 15 | Information Disclosure | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00085, EPSS Percentile is 0.35549 |
redos: CVE-2022-23498 was patched at 2024-04-04, 2024-04-05
49. Incorrect Calculation - Unknown Product (CVE-2023-42118) - High [500]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
1.0 | 18 | Exploitation in the wild is mentioned on BDU website | |
0.5 | 17 | The existence of a private exploit is mentioned on BDU:PrivateExploit website | |
0.5 | 15 | Incorrect Calculation | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to BDU data source | |
0 | 10 | EPSS Probability is 0, EPSS Percentile is 0 |
debian: CVE-2023-42118 was patched at 2024-05-15
redos: CVE-2023-42118 was patched at 2024-04-04
50. Remote Code Execution - Unknown Product (CVE-2023-34087) - High [500]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An improper array index validation vulnerability exists in the EVCD var len parsing functionality of GTKWave 3.3.115. A specially crafted .evcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-34087 was patched at 2024-04-03, 2024-05-15
51. Remote Code Execution - Unknown Product (CVE-2023-35004) - High [500]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An integer overflow vulnerability exists in the VZT longest_len value allocation functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.2214 |
debian: CVE-2023-35004 was patched at 2024-04-03, 2024-05-15
52. Authentication Bypass - Unknown Product (CVE-2023-48239) - High [484]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Enterprise Server, a malicious user could update any personal or global external storage, making them inaccessible for everyone else as well. Nextcloud Server 25.0.13, 26.0.8, and 27.1.3 and Nextcloud Enterprise Server is upgraded to 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8, and 27.1.3 contain a patch for this issue. As a workaround, disable app files_external. This workaround also makes the external storage inaccessible but retains the configurations until a patched version has been deployed.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.98 | 15 | Authentication Bypass | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 7.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00052, EPSS Percentile is 0.18781 |
redos: CVE-2023-48239 was patched at 2024-04-02
53. Security Feature Bypass - Unknown Product (CVE-2023-48946) - High [482]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue in the box_mpy function of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
debian: CVE-2023-48946 was patched at 2024-05-15
redos: CVE-2023-48946 was patched at 2024-04-02
54. Security Feature Bypass - Unknown Product (CVE-2023-48949) - High [482]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue in the box_add function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
debian: CVE-2023-48949 was patched at 2024-05-15
redos: CVE-2023-48949 was patched at 2024-04-02
55. Security Feature Bypass - Unknown Product (CVE-2023-51765) - High [482]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.3. According to Vulners data source | |
0.5 | 10 | EPSS Probability is 0.00173, EPSS Percentile is 0.53914 |
debian: CVE-2023-51765 was patched at 2024-05-15
redos: CVE-2023-51765 was patched at 2024-04-08
56. Denial of Service - GPAC (CVE-2023-46871) - High [477]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.5 | 10 | CVSS Base Score is 5.3. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
debian: CVE-2023-46871 was patched at 2024-05-15
redos: CVE-2023-46871 was patched at 2024-04-05
57. Memory Corruption - GPAC (CVE-2023-48011) - High [477]
Description: GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.20112 |
debian: CVE-2023-48011 was patched at 2024-05-15
redos: CVE-2023-48011 was patched at 2024-04-05
58. Memory Corruption - GPAC (CVE-2023-48013) - High [477]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf_filterpacket_del function at /gpac/src/filter_core/filter.c.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.20112 |
debian: CVE-2023-48013 was patched at 2024-05-15
redos: CVE-2023-48013 was patched at 2024-04-05
59. Memory Corruption - GPAC (CVE-2023-48014) - High [477]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc_parse_vps_extension function at /media_tools/av_parsers.c.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.20112 |
debian: CVE-2023-48014 was patched at 2024-05-15
redos: CVE-2023-48014 was patched at 2024-04-05
60. Denial of Service - Unknown Product (CVE-2023-3430) - High [470]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to pass a specially crafted file to the application, which triggers a heap-based buffer overflow and could cause a crash, leading to a denial of service.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00093, EPSS Percentile is 0.39006 |
debian: CVE-2023-3430 was patched at 2024-05-15
redos: CVE-2023-3430 was patched at 2024-04-08
61. Remote Code Execution - ICMP (CVE-2023-32727) - High [466]
Description: An attacker who has the privilege to configure Zabbix items can use function
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.8 | 14 | The Internet Control Message Protocol (ICMP) is a network layer protocol used by network devices to diagnose network communication issues | |
0.7 | 10 | CVSS Base Score is 7.2. According to Vulners data source | |
0.6 | 10 | EPSS Probability is 0.00206, EPSS Percentile is 0.58248 |
debian: CVE-2023-32727 was patched at 2024-05-15
redos: CVE-2023-32727 was patched at 2024-03-28
62. Denial of Service - MediaWiki (CVE-2024-34506) - High [455]
Description: An issue was discovered in includes/specials/SpecialMovePage.php in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.08981 |
debian: CVE-2024-34506 was patched at 2024-03-31, 2024-05-15
redos: CVE-2024-34506 was patched at 2024-05-14
63. Memory Corruption - GPAC (CVE-2023-48090) - High [453]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.7 | 10 | CVSS Base Score is 7.1. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14045 |
debian: CVE-2023-48090 was patched at 2024-05-15
redos: CVE-2023-48090 was patched at 2024-04-02
64. Denial of Service - Unknown Product (CVE-2023-48945) - High [446]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A stack overflow in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
debian: CVE-2023-48945 was patched at 2024-05-15
redos: CVE-2023-48945 was patched at 2024-04-02
65. Denial of Service - Unknown Product (CVE-2023-48950) - High [446]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue in the box_col_len function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
debian: CVE-2023-48950 was patched at 2024-05-15
redos: CVE-2023-48950 was patched at 2024-04-02
66. Denial of Service - Unknown Product (CVE-2023-48951) - High [446]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue in the box_equal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
debian: CVE-2023-48951 was patched at 2024-05-15
redos: CVE-2023-48951 was patched at 2024-04-02
67. Memory Corruption - Unknown Product (CVE-2023-49460) - High [446]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode_uncompressed_image.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00087, EPSS Percentile is 0.36481 |
debian: CVE-2023-49460 was patched at 2024-05-15
redos: CVE-2023-49460 was patched at 2024-04-08
68. Memory Corruption - Unknown Product (CVE-2023-49462) - High [446]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00094, EPSS Percentile is 0.39118 |
debian: CVE-2023-49462 was patched at 2024-05-15
redos: CVE-2023-49462 was patched at 2024-04-08
69. Memory Corruption - Unknown Product (CVE-2023-49463) - High [446]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00094, EPSS Percentile is 0.39118 |
debian: CVE-2023-49463 was patched at 2024-05-15
redos: CVE-2023-49463 was patched at 2024-04-08
70. Memory Corruption - Unknown Product (CVE-2023-49464) - High [446]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get_luma_bits_per_pixel_from_configuration_unci.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00094, EPSS Percentile is 0.39118 |
debian: CVE-2023-49464 was patched at 2024-05-15
redos: CVE-2023-49464 was patched at 2024-04-08
71. Security Feature Bypass - Unknown Product (CVE-2024-2756) - High [446]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 6.5. According to BDU data source | |
0 | 10 | EPSS Probability is 0, EPSS Percentile is 0 |
debian: CVE-2024-2756 was patched at 2024-04-15, 2024-05-15
ubuntu: CVE-2024-2756 was patched at 2024-04-29, 2024-05-02
72. Memory Corruption - GPAC (CVE-2023-48039) - High [441]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11781 |
debian: CVE-2023-48039 was patched at 2024-05-15
redos: CVE-2023-48039 was patched at 2024-04-02
73. Memory Corruption - GPAC (CVE-2023-48958) - High [441]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11781 |
debian: CVE-2023-48958 was patched at 2024-05-15
redos: CVE-2023-48958 was patched at 2024-04-05
74. Code Injection - Perl (CVE-2023-29453) - High [439]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g., "var a = {{.}}"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template. Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported but will be exported in the release of Go 1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.97 | 15 | Code Injection | |
0.6 | 14 | Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00093, EPSS Percentile is 0.3896 |
debian: CVE-2023-29453 was patched at 2024-05-15
redos: CVE-2023-29453 was patched at 2024-03-29
75. Denial of Service - Unknown Product (CVE-2023-49554) - High [434]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Use After Free vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the do_directive function in the modules/preprocs/nasm/nasm-pp.c component.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00067, EPSS Percentile is 0.28144 |
debian: CVE-2023-49554 was patched at 2024-05-15
redos: CVE-2023-49554 was patched at 2024-04-09
76. Denial of Service - Unknown Product (CVE-2023-49555) - High [434]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs/nasm/nasm-pp.c component.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00068, EPSS Percentile is 0.2844 |
debian: CVE-2023-49555 was patched at 2024-05-15
redos: CVE-2023-49555 was patched at 2024-04-09
77. Denial of Service - Unknown Product (CVE-2023-49556) - High [434]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expr_delete_term function in the libyasm/expr.c component.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00068, EPSS Percentile is 0.2844 |
debian: CVE-2023-49556 was patched at 2024-05-15
redos: CVE-2023-49556 was patched at 2024-04-09
78. Denial of Service - Unknown Product (CVE-2023-49557) - High [434]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm/section.c component.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00068, EPSS Percentile is 0.2844 |
debian: CVE-2023-49557 was patched at 2024-05-15
redos: CVE-2023-49557 was patched at 2024-04-09
79. Denial of Service - Unknown Product (CVE-2023-49558) - High [434]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_mmac_params function in the modules/preprocs/nasm/nasm-pp.c component.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00068, EPSS Percentile is 0.2844 |
debian: CVE-2023-49558 was patched at 2024-05-15
redos: CVE-2023-49558 was patched at 2024-04-09
80. Authentication Bypass - GitLab (CVE-2024-23901) - High [432]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.9 | 14 | GitLab is a DevOps software package that combines the ability to develop, secure, and operate software in a single application | |
0.7 | 10 | CVSS Base Score is 6.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
redos: CVE-2024-23901 was patched at 2024-04-11
81. Denial of Service - QEMU (CVE-2022-36648) - High [432]
Description: The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | QEMU is a generic and open source machine & userspace emulator and virtualizer | |
1.0 | 10 | CVSS Base Score is 10.0. According to Vulners data source | |
0.6 | 10 | EPSS Probability is 0.00207, EPSS Percentile is 0.58252 |
debian: CVE-2022-36648 was patched at 2024-05-15
redos: CVE-2022-36648 was patched at 2024-04-01
82. Information Disclosure - Apache Tomcat (CVE-2023-34981) - High [431]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.83 | 15 | Information Disclosure | |
0.7 | 14 | Apache Tomcat is a free and open-source implementation of the Jakarta Servlet, Jakarta Expression Language, and WebSocket technologies | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.6 | 10 | EPSS Probability is 0.00227, EPSS Percentile is 0.60533 |
redos: CVE-2023-34981 was patched at 2024-04-10
83. Cross Site Scripting - Unknown Product (CVE-2023-48301) - High [428]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles name that would be opened when clicking the circle name in a search filter. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.13, 26.0.8, and 27.1.3 contain a fix for this issue. As a workaround, disable app circles.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.8 | 15 | Cross Site Scripting | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00051, EPSS Percentile is 0.18467 |
redos: CVE-2023-48301 was patched at 2024-04-02
84. Denial of Service - Unknown Product (CVE-2021-37519) - High [422]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.17537 |
debian: CVE-2021-37519 was patched at 2024-05-15
redos: CVE-2021-37519 was patched at 2024-04-12
85. Authentication Bypass - Jenkins (CVE-2024-23898) - High [417]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability, allowing attackers to execute CLI commands on the Jenkins controller.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.6 | 14 | Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00071, EPSS Percentile is 0.29591 |
redos: CVE-2024-23898 was patched at 2024-04-11
86. Path Traversal - Windows Kernel (CVE-2023-45283) - High [417]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Path Traversal | |
0.9 | 14 | Windows Kernel | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00098, EPSS Percentile is 0.40255 |
debian: CVE-2023-45283 was patched at 2024-05-15
redos: CVE-2023-45283 was patched at 2024-04-02
87. Code Injection - Node.js (CVE-2024-21892) - High [413]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE.\nDue to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set.\nThis allows unprivileged users to inject code that inherits the process's elevated privileges.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.97 | 15 | Code Injection | |
0.8 | 14 | Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
almalinux: CVE-2024-21892 was patched at 2024-03-25, 2024-03-26, 2024-04-08
debian: CVE-2024-21892 was patched at 2024-05-15
oraclelinux: CVE-2024-21892 was patched at 2024-03-26, 2024-04-08
redhat: CVE-2024-21892 was patched at 2024-03-25, 2024-03-26, 2024-04-08, 2024-04-18, 2024-04-22
88. Denial of Service - Unknown Product (CVE-2024-0684) - High [410]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
redos: CVE-2024-0684 was patched at 2024-04-09
89. Denial of Service - Unknown Product (CVE-2024-1441) - High [410]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack by causing the libvirt daemon to crash.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([githubexploit] Exploit for CVE-2024-1441) | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14059 |
almalinux: CVE-2024-1441 was patched at 2024-04-30
debian: CVE-2024-1441 was patched at 2024-05-15
oraclelinux: CVE-2024-1441 was patched at 2024-04-10, 2024-05-07, 2024-06-03, 2024-06-13
redhat: CVE-2024-1441 was patched at 2024-04-30
redos: CVE-2024-1441 was patched at 2024-04-15
ubuntu: CVE-2024-1441 was patched at 2024-04-15, 2024-04-29
90. Incorrect Calculation - Unknown Product (CVE-2023-32650) - High [410]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An integer overflow vulnerability exists in the FST_BL_GEOM parsing maxhandle functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Incorrect Calculation | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.21725 |
debian: CVE-2023-32650 was patched at 2024-04-03, 2024-05-15
91. Memory Corruption - Unknown Product (CVE-2023-43907) - High [410]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.19989 |
debian: CVE-2023-43907 was patched at 2024-05-15
redos: CVE-2023-43907 was patched at 2024-04-04
92. Memory Corruption - Unknown Product (CVE-2023-51713) - High [410]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.19793 |
debian: CVE-2023-51713 was patched at 2024-05-15
redos: CVE-2023-51713 was patched at 2024-04-08
93. Memory Corruption - Unknown Product (CVE-2024-22563) - High [410]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
debian: CVE-2024-22563 was patched at 2024-05-15
redos: CVE-2024-22563 was patched at 2024-04-11
94. Remote Code Execution - Jenkins (CVE-2023-43496) - High [409]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.6 | 14 | Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21494 |
redos: CVE-2023-43496 was patched at 2024-04-11
95. Denial of Service - Unknown Product (CVE-2024-25126) - Medium [398]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2024-25126 was patched at 2024-04-30, 2024-05-22
debian: CVE-2024-25126 was patched at 2024-05-15, 2024-05-24
oraclelinux: CVE-2024-25126 was patched at 2024-05-02, 2024-05-23
redhat: CVE-2024-25126 was patched at 2024-04-16, 2024-04-23, 2024-04-30, 2024-05-22, 2024-05-28
redos: CVE-2024-25126 was patched at 2024-05-08
96. Incorrect Calculation - Unknown Product (CVE-2023-52339) - Medium [398]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Incorrect Calculation | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 6.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00061, EPSS Percentile is 0.24678 |
debian: CVE-2023-52339 was patched at 2024-05-15
redos: CVE-2023-52339 was patched at 2024-04-02
97. Path Traversal - Sudo (CVE-2023-42456) - Medium [394]
Description: Sudo-rs, a memory safe implementation of
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Path Traversal | |
0.9 | 14 | Sudo is a program for Unix-like computer operating systems that allows users to run programs with the security privileges of another user | |
0.8 | 10 | CVSS Base Score is 8.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00061, EPSS Percentile is 0.24892 |
redos: CVE-2023-42456 was patched at 2024-03-28
98. Information Disclosure - Perl (CVE-2023-4457) - Medium [391]
Description: Grafana is an open-source platform for monitoring and observability.
The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.83 | 15 | Information Disclosure | |
0.6 | 14 | Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00087, EPSS Percentile is 0.36233 |
redos: CVE-2023-4457 was patched at 2024-04-03, 2024-04-05
99. Security Feature Bypass - Python (CVE-2021-21238) - Medium [391]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.6 | 14 | Python is a high-level, general-purpose programming language | |
0.7 | 10 | CVSS Base Score is 6.5. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00107, EPSS Percentile is 0.42913 |
debian: CVE-2021-21238 was patched at 2024-05-15
redos: CVE-2021-21238 was patched at 2024-04-10
100. Denial of Service - QEMU (CVE-2022-3872) - Medium [384]
Description: An off-by-one read/write issue was found in the SDHCI device of
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | QEMU is a generic and open source machine & userspace emulator and virtualizer | |
0.9 | 10 | CVSS Base Score is 8.6. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00071, EPSS Percentile is 0.29773 |
debian: CVE-2022-3872 was patched at 2024-05-15
redos: CVE-2022-3872 was patched at 2024-03-29
101. Security Feature Bypass - GitLab (CVE-2024-23902) - Medium [382]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers to connect to an attacker-specified URL.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.9 | 14 | GitLab is a DevOps software package that combines the ability to develop, secure, and operate software in a single application | |
0.4 | 10 | CVSS Base Score is 4.3. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
redos: CVE-2024-23902 was patched at 2024-04-11
102. Remote Code Execution - TRIE (CVE-2023-34436) - Medium [380]
Description: An out-of-bounds write vulnerability exists in the LXT2 num_time_table_en
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.5 | 14 | TRIE | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-34436 was patched at 2024-04-03, 2024-05-15
103. Remote Code Execution - TRIE (CVE-2023-39316) - Medium [380]
Description: Multiple integer overflow vulnerabilities exist in the LXT2 num_dict_en
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.5 | 14 | TRIE | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.2214 |
debian: CVE-2023-39316 was patched at 2024-04-03, 2024-05-15
104. Remote Code Execution - TRIE (CVE-2023-39317) - Medium [380]
Description: Multiple integer overflow vulnerabilities exist in the LXT2 num_dict_en
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.5 | 14 | TRIE | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.2214 |
debian: CVE-2023-39317 was patched at 2024-04-03, 2024-05-15
105. Remote Code Execution - Unknown Product (CVE-2023-5550) - Medium [380]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.7 | 10 | EPSS Probability is 0.00323, EPSS Percentile is 0.7038 |
redos: CVE-2023-5550 was patched at 2024-04-03
106. Security Feature Bypass - Jenkins (CVE-2023-43497) - Medium [379]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.6 | 14 | Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. | |
0.8 | 10 | CVSS Base Score is 8.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.17886 |
redos: CVE-2023-43497 was patched at 2024-04-11
107. Security Feature Bypass - Wireshark (CVE-2024-0208) - Medium [379]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.6 | 14 | Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21462 |
debian: CVE-2024-0208 was patched at 2024-05-15
redos: CVE-2024-0208 was patched at 2024-04-09
108. Denial of Service - OpenSSL (CVE-2024-1394) - Medium [377]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs\u200b. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey\u200b and ctx\u200b. That function uses named return parameters to free pkey\u200b and ctx\u200b if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey\u200b and ctx\u200b will be nil inside the deferred function that should free them.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.8 | 14 | A software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.17063 |
almalinux: CVE-2024-1394 was patched at 2024-03-21, 2024-03-25, 2024-04-02, 2024-04-30, 2024-05-22
oraclelinux: CVE-2024-1394 was patched at 2024-03-21, 2024-03-22, 2024-03-26, 2024-04-03, 2024-05-07, 2024-05-29
redhat: CVE-2024-1394 was patched at 2024-03-21, 2024-03-25, 2024-04-02, 2024-04-03, 2024-04-18, 2024-04-26, 2024-04-30, 2024-05-22
109. Authentication Bypass - MediaWiki (CVE-2023-45370) - Medium [375]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams: Special:SportsManagerLogo and Special:SportsTeamsManagerLogo do not check for the sportsteamsmanager user right, and thus an attacker may be able to affect pages that are concerned with sports teams.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.5 | 10 | CVSS Base Score is 5.3. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
redos: CVE-2023-45370 was patched at 2024-04-05
110. Memory Corruption - Unknown Product (CVE-2023-50246) - Medium [375]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
redos: CVE-2023-50246 was patched at 2024-04-08
111. Memory Corruption - Unknown Product (CVE-2023-50268) - Medium [375]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'jq is a command-line JSON processor. Version 1.7 is vulnerable to stack-based buffer overflow in builds using decNumber. Version 1.7.1 contains a patch for this issue.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
redos: CVE-2023-50268 was patched at 2024-04-08
112. Denial of Service - Linux Kernel (CVE-2024-24857) - Medium [370]
Description: A race condition was found in the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.7 | 10 | CVSS Base Score is 6.8. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14045 |
debian: CVE-2024-24857 was patched at 2024-04-13, 2024-05-06, 2024-05-15
113. Memory Corruption - Linux Kernel (CVE-2023-1194) - Medium [370]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. When an attacker sends the CREATE command with a malformed payload to KSMBD, due to a missing check of `NameOffset` in the `parse_lease_state()` function, the `create_context` object can access invalid memory.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 8.1. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00066, EPSS Percentile is 0.27787 |
debian: CVE-2023-1194 was patched at 2024-05-15
ubuntu: CVE-2023-1194 was patched at 2024-04-09, 2024-04-16
114. Remote Code Execution - TRIE (CVE-2024-31083) - Medium [369]
Description: A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple en
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.5 | 14 | TRIE | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2024-31083 was patched at 2024-04-24, 2024-04-30, 2024-05-22, 2024-05-23
debian: CVE-2024-31083 was patched at 2024-04-12, 2024-05-15
oraclelinux: CVE-2024-31083 was patched at 2024-04-11, 2024-04-24, 2024-04-29, 2024-05-07, 2024-05-29
redhat: CVE-2024-31083 was patched at 2024-04-11, 2024-04-24, 2024-04-29, 2024-04-30, 2024-05-22, 2024-05-23
redos: CVE-2024-31083 was patched at 2024-05-07
ubuntu: CVE-2024-31083 was patched at 2024-04-04
115. Path Traversal - Jenkins (CVE-2024-23904) - Medium [367]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file system.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Path Traversal | |
0.6 | 14 | Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00093, EPSS Percentile is 0.38874 |
redos: CVE-2024-23904 was patched at 2024-04-11
116. Path Traversal - Node.js (CVE-2024-21896) - Medium [365]
Description: The permission model protects itself against
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Path Traversal | |
0.8 | 14 | Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more | |
0.8 | 10 | CVSS Base Score is 7.9. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
almalinux: CVE-2024-21896 was patched at 2024-04-08
oraclelinux: CVE-2024-21896 was patched at 2024-04-08
redhat: CVE-2024-21896 was patched at 2024-04-08
117. Security Feature Bypass - Docker (CVE-2024-24557) - Medium [363]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.5 | 14 | Docker | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.20112 |
debian: CVE-2024-24557 was patched at 2024-05-15
redos: CVE-2024-24557 was patched at 2024-04-10
118. Denial of Service - MediaWiki (CVE-2023-45371) - Medium [360]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
redos: CVE-2023-45371 was patched at 2024-04-05
119. Security Feature Bypass - MediaWiki (CVE-2023-45372) - Medium [360]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.5 | 10 | CVSS Base Score is 5.3. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
redos: CVE-2023-45372 was patched at 2024-04-05
120. Security Feature Bypass - MediaWiki (CVE-2023-45374) - Medium [360]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It does not check for the anti-CSRF edit token in Special:SportsTeamsManager and Special:UpdateFavoriteTeams.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.5 | 10 | CVSS Base Score is 5.3. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
redos: CVE-2023-45374 was patched at 2024-04-05
121. Denial of Service - Linux Kernel (CVE-2023-52435) - Medium [358]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
debian: CVE-2023-52435 was patched at 2024-05-06, 2024-05-15
ubuntu: CVE-2023-52435 was patched at 2024-04-09, 2024-04-16, 2024-05-07, 2024-05-14, 2024-05-15, 2024-05-20, 2024-05-28, 2024-06-11
122. Denial of Service - Linux Kernel (CVE-2024-23850) - Medium [358]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out too soon after its root item is inserted upon subvolume creation.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
debian: CVE-2024-23850 was patched at 2024-05-06, 2024-05-15
ubuntu: CVE-2024-23850 was patched at 2024-04-09, 2024-04-16
123. Denial of Service - Linux Kernel (CVE-2024-23851) - Medium [358]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to ctl_ioctl.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
debian: CVE-2024-23851 was patched at 2024-05-06, 2024-05-15
ubuntu: CVE-2024-23851 was patched at 2024-04-09, 2024-04-16, 2024-04-17, 2024-04-19
124. Remote Code Execution - Unknown Product (CVE-2023-32728) - Medium [357]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.5 | 10 | EPSS Probability is 0.00134, EPSS Percentile is 0.48051 |
debian: CVE-2023-32728 was patched at 2024-05-15
redos: CVE-2023-32728 was patched at 2024-03-28
125. Unknown Vulnerability Type - Unknown Product (CVE-2021-43138) - Medium [357]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0 | 15 | Unknown Vulnerability Type | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.5 | 10 | EPSS Probability is 0.00132, EPSS Percentile is 0.47715 |
redos: CVE-2021-43138 was patched at 2024-04-03
126. Cross Site Scripting - MediaWiki (CVE-2023-45373) - Medium [354]
Description: An issue was discovered in the ProofreadPage extension for
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.8 | 15 | Cross Site Scripting | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.6 | 10 | CVSS Base Score is 6.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
redos: CVE-2023-45373 was patched at 2024-04-05
127. Denial of Service - Safari (CVE-2023-42956) - Medium [353]
Description: The issue was addressed with improved memory handling. This issue is fixed in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.8 | 14 | Safari is a web browser developed by Apple. It is built into Apple's operating systems, including macOS, iOS, iPadOS and their upcoming VisionOS, and uses Apple's open-source browser engine WebKit, which was derived from KHTML. | |
0.7 | 10 | CVSS Base Score is 6.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2023-42956 was patched at 2024-05-09, 2024-05-15
ubuntu: CVE-2023-42956 was patched at 2024-04-15
128. Security Feature Bypass - Chromium (CVE-2024-2631) - Medium [353]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.4 | 10 | CVSS Base Score is 4.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-2631 was patched at 2024-03-28, 2024-05-15
redos: CVE-2024-2631 was patched at 2024-05-03
129. Memory Corruption - Unknown Product (CVE-2024-2201) - Medium [351]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.1. According to BDU data source | |
0 | 10 | EPSS Probability is 0, EPSS Percentile is 0 |
almalinux: CVE-2024-22017 was patched at 2024-04-08
debian: CVE-2024-2201 was patched at 2024-04-13, 2024-05-15
oraclelinux: CVE-2024-2201 was patched at 2024-04-08, 2024-05-13, 2024-05-15
oraclelinux: CVE-2024-22017 was patched at 2024-04-08
redhat: CVE-2024-22017 was patched at 2024-04-08
ubuntu: CVE-2024-2201 was patched at 2024-05-07, 2024-05-15, 2024-05-16, 2024-05-20, 2024-05-28, 2024-06-11
130. Cross Site Scripting - Jenkins (CVE-2023-43495) - Medium [350]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.8 | 15 | Cross Site Scripting | |
0.6 | 14 | Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.0009, EPSS Percentile is 0.37708 |
redos: CVE-2023-43495 was patched at 2024-04-11
131. Denial of Service - QEMU (CVE-2023-6683) - Medium [348]
Description: A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | QEMU is a generic and open source machine & userspace emulator and virtualizer | |
0.7 | 10 | CVSS Base Score is 6.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00048, EPSS Percentile is 0.16468 |
almalinux: CVE-2023-6683 was patched at 2024-04-30
debian: CVE-2023-6683 was patched at 2024-05-15
oraclelinux: CVE-2023-6683 was patched at 2024-04-10, 2024-05-02, 2024-05-24, 2024-06-03
redhat: CVE-2023-6683 was patched at 2024-04-30, 2024-05-22
132. Security Feature Bypass - MediaWiki (CVE-2023-45364) - Medium [348]
Description: An issue was discovered in includes/page/Article.php in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.5 | 10 | CVSS Base Score is 5.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.12312 |
debian: CVE-2023-45364 was patched at 2024-05-15
redos: CVE-2023-45364 was patched at 2024-04-05
133. Denial of Service - Linux Kernel (CVE-2024-24858) - Medium [346]
Description: A race condition was found in the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.5 | 10 | CVSS Base Score is 5.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11781 |
debian: CVE-2024-24858 was patched at 2024-04-13, 2024-05-06, 2024-05-15
134. Memory Corruption - Linux Kernel (CVE-2023-52434) - Medium [346]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential OOBs in smb2_parse_contexts()\n\nValidate offsets and lengths before dereferencing create contexts in\nsmb2_parse_contexts().\n\nThis fixes following oops when accessing invalid create contexts from\nserver:\n\n BUG: unable to handle page fault for address: ffff8881178d8cc3\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 4a01067 P4D 4a01067 PUD 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs]\n Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00\n 00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7\n 7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00\n RSP: 0018:ffffc900007939e0 EFLAGS: 00010216\n RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90\n RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000\n RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000\n R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000\n R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22\n FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000)\n knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0\n PKRU: 55555554\n Call Trace:\n <TASK>\n ? __die+0x23/0x70\n ? page_fault_oops+0x181/0x480\n ? search_module_extables+0x19/0x60\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? exc_page_fault+0x1b6/0x1c0\n ? asm_exc_page_fault+0x26/0x30\n ? smb2_parse_contexts+0xa0/0x3a0 [cifs]\n SMB2_open+0x38d/0x5f0 [cifs]\n ? smb2_is_path_accessible+0x138/0x260 [cifs]\n smb2_is_path_accessible+0x138/0x260 [cifs]\n cifs_is_path_remote+0x8d/0x230 [cifs]\n cifs_mount+0x7e/0x350 [cifs]\n cifs_smb3_do_mount+0x128/0x780 [cifs]\n smb3_get_tree+0xd9/0x290 [cifs]\n vfs_get_tree+0x2c/0x100\n ? capable+0x37/0x70\n path_mount+0x2d7/0xb80\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x44/0x60\n __x64_sys_mount+0x11a/0x150\n do_syscall_64+0x47/0xf0\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\n RIP: 0033:0x7f8737657b1e', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 8.0. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
almalinux: CVE-2023-52434 was patched at 2024-05-22
debian: CVE-2023-52434 was patched at 2024-05-06, 2024-05-15
oraclelinux: CVE-2023-52434 was patched at 2024-05-02, 2024-05-23
redhat: CVE-2023-52434 was patched at 2024-05-22
ubuntu: CVE-2023-52434 was patched at 2024-04-09, 2024-04-16, 2024-06-07, 2024-06-10, 2024-06-11, 2024-06-14
135. Memory Corruption - Linux Kernel (CVE-2023-52441) - Medium [346]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out of bounds in init_smb2_rsp_hdr()\n\nIf client send smb2 negotiate request and then send smb1 negotiate\nrequest, init_smb2_rsp_hdr is called for smb1 negotiate request since\nneed_neg is set to false. This patch ignore smb1 packets after ->need_neg\nis set to false.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14408 |
debian: CVE-2023-52441 was patched at 2024-05-15
ubuntu: CVE-2023-52441 was patched at 2024-04-09, 2024-04-16
136. Memory Corruption - Linux Kernel (CVE-2024-26586) - Medium [346]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix stack corruption\n\nWhen tc filters are first added to a net device, the corresponding local\nport gets bound to an ACL group in the device. The group contains a list\nof ACLs. In turn, each ACL points to a different TCAM region where the\nfilters are stored. During forwarding, the ACLs are sequentially\nevaluated until a match is found.\n\nOne reason to place filters in different regions is when they are added\nwith decreasing priorities and in an alternating order so that two\nconsecutive filters can never fit in the same region because of their\nkey usage.\n\nIn Spectrum-2 and newer ASICs the firmware started to report that the\nmaximum number of ACLs in a group is more than 16, but the layout of the\nregister that configures ACL groups (PAGT) was not updated to account\nfor that. It is therefore possible to hit stack corruption [1] in the\nrare case where more than 16 ACLs in a group are required.\n\nFix by limiting the maximum ACL group size to the minimum between what\nthe firmware reports and the maximum ACLs that fit in the PAGT register.\n\nAdd a test case to make sure the machine does not crash when this\ncondition is hit.\n\n[1]\nKernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120\n[...]\n dump_stack_lvl+0x36/0x50\n panic+0x305/0x330\n __stack_chk_fail+0x15/0x20\n mlxsw_sp_acl_tcam_group_update+0x116/0x120\n mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110\n mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20\n mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0\n mlxsw_sp_acl_rule_add+0x47/0x240\n mlxsw_sp_flower_replace+0x1a9/0x1d0\n tc_setup_cb_add+0xdc/0x1c0\n fl_hw_replace_filter+0x146/0x1f0\n fl_change+0xc17/0x1360\n tc_new_tfilter+0x472/0xb90\n rtnetlink_rcv_msg+0x313/0x3b0\n netlink_rcv_skb+0x58/0x100\n netlink_unicast+0x244/0x390\n netlink_sendmsg+0x1e4/0x440\n ____sys_sendmsg+0x164/0x260\n ___sys_sendmsg+0x9a/0xe0\n __sys_sendmsg+0x7a/0xc0\n do_syscall_64+0x40/0xe0\n entry_SYSCALL_64_after_hwframe+0x63/0x6b', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
debian: CVE-2024-26586 was patched at 2024-05-15
oraclelinux: CVE-2024-26586 was patched at 2024-05-02
redhat: CVE-2024-26586 was patched at 2024-04-18, 2024-04-23, 2024-04-30, 2024-05-02, 2024-05-28, 2024-06-11
ubuntu: CVE-2024-26586 was patched at 2024-04-09, 2024-04-16, 2024-06-07, 2024-06-10, 2024-06-11, 2024-06-12, 2024-06-14
137. Security Feature Bypass - Git (CVE-2022-46176) - Medium [346]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH (through git's [`url.<base>.insteadOf`][1] setting), as that'd cause you to clone the crates.io index through SSH. Rust 1.66.1 will ensure Cargo checks the SSH host key and abort the connection if the server's public key is not already trusted. We recommend everyone to upgrade as soon as possible. ', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.4 | 14 | Git | |
0.6 | 10 | CVSS Base Score is 5.9. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00093, EPSS Percentile is 0.38739 |
debian: CVE-2022-46176 was patched at 2024-05-15
redos: CVE-2022-46176 was patched at 2024-04-03
138. Cross Site Scripting - Unknown Product (CVE-2022-31097) - Medium [345]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.8 | 15 | Cross Site Scripting | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 8.7. According to Vulners data source | |
0.8 | 10 | EPSS Probability is 0.00661, EPSS Percentile is 0.79346 |
redos: CVE-2022-31097 was patched at 2024-04-03
139. Remote Code Execution - Unknown Product (CVE-2023-40547) - Medium [345]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise. This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-Middle or compromise the boot server to be able to exploit this vulnerability successfully.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 8.3. According to Vulners data source | |
0.6 | 10 | EPSS Probability is 0.00247, EPSS Percentile is 0.64344 |
almalinux: CVE-2023-40547 was patched at 2024-04-18
debian: CVE-2023-40547 was patched at 2024-05-15
oraclelinux: CVE-2023-40547 was patched at 2024-04-22, 2024-04-25, 2024-05-01
redhat: CVE-2023-40547 was patched at 2024-04-16, 2024-04-18, 2024-04-23, 2024-04-29
redos: CVE-2023-40547 was patched at 2024-04-11
140. Unknown Vulnerability Type - Unknown Product (CVE-2021-46854) - Medium [345]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'mod_radius in ProFTPD before 1.3.7c allows memory disclosure to RADIUS servers because it copies blocks of 16 characters.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0 | 15 | Unknown Vulnerability Type | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00113, EPSS Percentile is 0.4433 |
debian: CVE-2021-46854 was patched at 2024-05-15
redos: CVE-2021-46854 was patched at 2024-04-04
141. Denial of Service - Wireshark (CVE-2024-0209) - Medium [344]
Description: IEEE 1609.2 dissector crash in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.6 | 14 | Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
debian: CVE-2024-0209 was patched at 2024-05-15
redos: CVE-2024-0209 was patched at 2024-04-09
142. Memory Corruption - Perl (CVE-2023-47100) - Medium [344]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \\p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.6 | 14 | Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00063, EPSS Percentile is 0.26202 |
redos: CVE-2023-47100 was patched at 2024-03-28
143. Denial of Service - RPC (CVE-2024-2494) - Medium [341]
Description: A flaw was found in the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.8 | 14 | Remote Procedure Call Runtime | |
0.6 | 10 | CVSS Base Score is 6.2. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2024-2494 was patched at 2024-04-30
debian: CVE-2024-2494 was patched at 2024-05-15
oraclelinux: CVE-2024-2494 was patched at 2024-05-07, 2024-05-30
redhat: CVE-2024-2494 was patched at 2024-04-30, 2024-05-22
redos: CVE-2024-2494 was patched at 2024-04-23
ubuntu: CVE-2024-2494 was patched at 2024-04-15, 2024-04-29
144. Memory Corruption - Chromium (CVE-2024-2625) - Medium [341]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-2625 was patched at 2024-03-28, 2024-05-15
redos: CVE-2024-2625 was patched at 2024-05-03
145. Memory Corruption - Chromium (CVE-2024-2627) - Medium [341]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-2627 was patched at 2024-03-28, 2024-05-15
redos: CVE-2024-2627 was patched at 2024-05-03
146. Elevation of Privilege - Perl (CVE-2023-0594) - Medium [335]
Description: Grafana is an open-source platform for monitoring and observability.
Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization.
The stored XSS vulnerability was possible due the value of a span's attributes/resources were not pro
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.85 | 15 | Elevation of Privilege | |
0.6 | 14 | Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.19604 |
redos: CVE-2023-0594 was patched at 2024-04-04, 2024-04-05
147. Path Traversal - Jenkins (CVE-2024-23899) - Medium [332]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Path Traversal | |
0.6 | 14 | Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. | |
0.7 | 10 | CVSS Base Score is 6.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00049, EPSS Percentile is 0.16606 |
redos: CVE-2024-23899 was patched at 2024-04-11
148. Unknown Vulnerability Type - iOS (CVE-2024-28085) - Medium [330]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([packetstorm] util-linux wall Escape Sequence Injection, [githubexploit] Exploit for CVE-2024-28085) | |
0 | 15 | Unknown Vulnerability Type | |
0.7 | 14 | iOS is an operating system developed and marketed by Apple Inc | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.09453 |
debian: CVE-2024-28085 was patched at 2024-03-31, 2024-05-15
redos: CVE-2024-28085 was patched at 2024-04-25
ubuntu: CVE-2024-28085 was patched at 2024-03-27, 2024-04-10
149. Remote Code Execution - Chromium (CVE-2024-2887) - Medium [323]
Description: Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14408 |
debian: CVE-2024-2887 was patched at 2024-03-28, 2024-05-15
redos: CVE-2024-2887 was patched at 2024-05-07
150. Information Disclosure - Git (CVE-2023-20898) - Medium [322]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.\n', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.83 | 15 | Information Disclosure | |
0.4 | 14 | Git | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
debian: CVE-2023-20898 was patched at 2024-05-15
redos: CVE-2023-20898 was patched at 2024-04-09
151. Security Feature Bypass - Oracle Java SE (CVE-2024-21068) - Medium [320]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and 22; Oracle GraalVM Enterprise Edition: 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.6 | 14 | Oracle Java SE | |
0.4 | 10 | CVSS Base Score is 3.7. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
almalinux: CVE-2024-21068 was patched at 2024-04-18, 2024-04-22
debian: CVE-2024-21068 was patched at 2024-04-22, 2024-05-15
oraclelinux: CVE-2024-21068 was patched at 2024-04-17, 2024-04-22, 2024-04-23
redhat: CVE-2024-21068 was patched at 2024-04-16, 2024-04-18, 2024-04-22
ubuntu: CVE-2024-21068 was patched at 2024-06-06
152. Security Feature Bypass - Oracle Java SE (CVE-2024-21094) - Medium [320]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.6 | 14 | Oracle Java SE | |
0.4 | 10 | CVSS Base Score is 3.7. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
almalinux: CVE-2024-21094 was patched at 2024-04-18, 2024-04-22
debian: CVE-2024-21094 was patched at 2024-04-22, 2024-05-15
oraclelinux: CVE-2024-21094 was patched at 2024-04-17, 2024-04-22, 2024-04-23
redhat: CVE-2024-21094 was patched at 2024-04-16, 2024-04-18, 2024-04-22
ubuntu: CVE-2024-21094 was patched at 2024-06-06
153. Code Injection - Mozilla Firefox (CVE-2024-29944) - Medium [318]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.97 | 15 | Code Injection | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2024-29944 was patched at 2024-03-25
debian: CVE-2024-29944 was patched at 2024-03-23, 2024-05-15
oraclelinux: CVE-2024-29944 was patched at 2024-03-26
redhat: CVE-2024-29944 was patched at 2024-03-25
ubuntu: CVE-2024-29944 was patched at 2024-03-25
154. Denial of Service - Chromium (CVE-2024-2629) - Medium [317]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Incorrect security UI in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.4 | 10 | CVSS Base Score is 4.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-2629 was patched at 2024-03-28, 2024-05-15
redos: CVE-2024-2629 was patched at 2024-05-03
155. Memory Corruption - Chromium (CVE-2024-2626) - Medium [317]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.7 | 10 | CVSS Base Score is 6.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-2626 was patched at 2024-03-28, 2024-05-15
redos: CVE-2024-2626 was patched at 2024-05-03
156. Denial of Service - TRIE (CVE-2023-40546) - Medium [315]
Description: A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.5 | 14 | TRIE | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00067, EPSS Percentile is 0.28297 |
almalinux: CVE-2023-40546 was patched at 2024-04-18
debian: CVE-2023-40546 was patched at 2024-05-15
oraclelinux: CVE-2023-40546 was patched at 2024-04-22, 2024-04-25, 2024-05-01
redhat: CVE-2023-40546 was patched at 2024-04-16, 2024-04-18, 2024-04-23, 2024-04-29
redos: CVE-2023-40546 was patched at 2024-04-11
157. Cross Site Scripting - Jenkins (CVE-2024-23905) - Medium [314]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.8 | 15 | Cross Site Scripting | |
0.6 | 14 | Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.12213 |
redos: CVE-2024-23905 was patched at 2024-04-11
158. Code Injection - Unknown Product (CVE-2023-37278) - Medium [304]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in version 10.0.9.\n\n', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.97 | 15 | Code Injection | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 9.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.17766 |
redos: CVE-2023-37278 was patched at 2024-03-28
159. Unknown Vulnerability Type - Windows LDAP (CVE-2023-32723) - Medium [304]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Request to LDAP is sent before user permissions are checked.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | Windows LDAP (Lightweight Directory Access Protocol) is an open and cross platform protocol used for directory services authentication | |
0.9 | 10 | CVSS Base Score is 9.1. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00091, EPSS Percentile is 0.3819 |
debian: CVE-2023-32723 was patched at 2024-05-15
redos: CVE-2023-32723 was patched at 2024-03-29
160. Denial of Service - Unknown Product (CVE-2023-49288) - Medium [303]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.7 | 10 | EPSS Probability is 0.00374, EPSS Percentile is 0.72451 |
debian: CVE-2023-49288 was patched at 2024-05-15
ubuntu: CVE-2023-49288 was patched at 2024-04-10, 2024-04-23
161. Path Traversal - Unknown Product (CVE-2019-1020001) - Medium [303]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'yard before 0.9.20 allows path traversal.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Path Traversal | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.7 | 10 | EPSS Probability is 0.00258, EPSS Percentile is 0.65188 |
debian: CVE-2019-1020001 was patched at 2024-05-15
ubuntu: CVE-2019-1020001 was patched at 2024-04-15
162. Path Traversal - Unknown Product (CVE-2023-52076) - Medium [303]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Path Traversal | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.7 | 10 | EPSS Probability is 0.00414, EPSS Percentile is 0.73733 |
debian: CVE-2023-52076 was patched at 2024-05-12, 2024-05-15
redos: CVE-2023-52076 was patched at 2024-04-12
ubuntu: CVE-2023-52076 was patched at 2024-06-05
163. Arbitrary File Reading - Unknown Product (CVE-2017-17042) - Medium [302]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.83 | 15 | Arbitrary File Reading | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.5 | 10 | EPSS Probability is 0.00155, EPSS Percentile is 0.51268 |
debian: CVE-2017-17042 was patched at 2024-05-15
ubuntu: CVE-2017-17042 was patched at 2024-04-15
164. Memory Corruption - Linux Kernel (CVE-2023-47233) - Medium [298]
Description: The brcm80211 component in the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.4 | 10 | CVSS Base Score is 4.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
debian: CVE-2023-47233 was patched at 2024-04-13, 2024-05-06, 2024-05-15
ubuntu: CVE-2023-47233 was patched at 2024-05-16, 2024-05-20, 2024-05-21, 2024-05-23, 2024-05-28, 2024-06-07, 2024-06-11, 2024-06-14
165. Remote Code Execution - Unknown Product (CVE-2023-35702) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint32 function.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-35702 was patched at 2024-04-03, 2024-05-15
166. Remote Code Execution - Unknown Product (CVE-2023-35703) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint64 function.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-35703 was patched at 2024-04-03, 2024-05-15
167. Remote Code Execution - Unknown Product (CVE-2023-35704) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the fstReaderVarint32WithSkip function.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-35704 was patched at 2024-04-03, 2024-05-15
168. Remote Code Execution - Unknown Product (CVE-2023-35955) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the decompression function `LZ4_decompress_safe_partial`.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-35955 was patched at 2024-04-03, 2024-05-15
169. Remote Code Execution - Unknown Product (CVE-2023-35956) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the decompression function `fastlz_decompress`.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-35956 was patched at 2024-04-03, 2024-05-15
170. Remote Code Execution - Unknown Product (CVE-2023-35957) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the decompression function `uncompress`.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-35957 was patched at 2024-04-03, 2024-05-15
171. Remote Code Execution - Unknown Product (CVE-2023-35958) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. A specially-crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the copy function `fstFread`.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-35958 was patched at 2024-04-03, 2024-05-15
172. Remote Code Execution - Unknown Product (CVE-2023-35969) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain_table parsing functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the chain_table of `FST_BL_VCDATA` and `FST_BL_VCDATA_DYN_ALIAS` section types.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-35969 was patched at 2024-04-03, 2024-05-15
173. Remote Code Execution - Unknown Product (CVE-2023-35970) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain_table parsing functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the chain_table of the `FST_BL_VCDATA_DYN_ALIAS2` section type.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-35970 was patched at 2024-04-03, 2024-05-15
174. Remote Code Execution - Unknown Product (CVE-2023-35989) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An integer overflow vulnerability exists in the LXT2 zlib block allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.2214 |
debian: CVE-2023-35989 was patched at 2024-04-03, 2024-05-15
175. Remote Code Execution - Unknown Product (CVE-2023-35994) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta initialization part.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-35994 was patched at 2024-04-03, 2024-05-15
176. Remote Code Execution - Unknown Product (CVE-2023-35995) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 1.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-35995 was patched at 2024-04-03, 2024-05-15
177. Remote Code Execution - Unknown Product (CVE-2023-35996) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 0.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-35996 was patched at 2024-04-03, 2024-05-15
178. Remote Code Execution - Unknown Product (CVE-2023-35997) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the tdelta indexing when signal_lens is 2 or more.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-35997 was patched at 2024-04-03, 2024-05-15
179. Remote Code Execution - Unknown Product (CVE-2023-36861) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An out-of-bounds write vulnerability exists in the VZT LZMA_read_varint functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-36861 was patched at 2024-04-03, 2024-05-15
180. Remote Code Execution - Unknown Product (CVE-2023-36864) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An integer overflow vulnerability exists in the fstReaderIterBlocks2 temp_signal_value_buf allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.2214 |
debian: CVE-2023-36864 was patched at 2024-04-03, 2024-05-15
181. Remote Code Execution - Unknown Product (CVE-2023-36915) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the FST fstReaderIterBlocks2 chain_table allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the allocation of the `chain_table` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.2214 |
debian: CVE-2023-36915 was patched at 2024-04-03, 2024-05-15
182. Remote Code Execution - Unknown Product (CVE-2023-36916) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the FST fstReaderIterBlocks2 chain_table allocation functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the allocation of the `chain_table_lengths` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.2214 |
debian: CVE-2023-36916 was patched at 2024-04-03, 2024-05-15
183. Remote Code Execution - Unknown Product (CVE-2023-37282) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An out-of-bounds write vulnerability exists in the VZT LZMA_Read dmem extraction functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37282 was patched at 2024-04-03, 2024-05-15
184. Remote Code Execution - Unknown Product (CVE-2023-37416) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the GUI's legacy VCD parsing code.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-37416 was patched at 2024-04-03, 2024-05-15
185. Remote Code Execution - Unknown Product (CVE-2023-37417) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the GUI's interactive VCD parsing code.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-37417 was patched at 2024-04-03, 2024-05-15
186. Remote Code Execution - Unknown Product (CVE-2023-37418) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2vzt conversion utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37418 was patched at 2024-04-03, 2024-05-15
187. Remote Code Execution - Unknown Product (CVE-2023-37419) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt2 conversion utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37419 was patched at 2024-04-03, 2024-05-15
188. Remote Code Execution - Unknown Product (CVE-2023-37420) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds write vulnerabilities exist in the VCD parse_valuechange portdump functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt conversion utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37420 was patched at 2024-04-03, 2024-05-15
189. Remote Code Execution - Unknown Product (CVE-2023-37442) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds read when triggered via the GUI's default VCD parsing code.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-37442 was patched at 2024-04-03, 2024-05-15
190. Remote Code Execution - Unknown Product (CVE-2023-37443) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds read when triggered via the GUI's legacy VCD parsing code.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-37443 was patched at 2024-04-03, 2024-05-15
191. Remote Code Execution - Unknown Product (CVE-2023-37444) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds read when triggered via the GUI's interactive VCD parsing code.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-37444 was patched at 2024-04-03, 2024-05-15
192. Remote Code Execution - Unknown Product (CVE-2023-37445) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2vzt conversion utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37445 was patched at 2024-04-03, 2024-05-15
193. Remote Code Execution - Unknown Product (CVE-2023-37446) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt2 conversion utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37446 was patched at 2024-04-03, 2024-05-15
194. Remote Code Execution - Unknown Product (CVE-2023-37447) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when triggered via the vcd2lxt conversion utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37447 was patched at 2024-04-03, 2024-05-15
195. Remote Code Execution - Unknown Product (CVE-2023-37573) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI's recoder (default) VCD parsing code.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-37573 was patched at 2024-04-03, 2024-05-15
196. Remote Code Execution - Unknown Product (CVE-2023-37574) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI's legacy VCD parsing code.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-37574 was patched at 2024-04-03, 2024-05-15
197. Remote Code Execution - Unknown Product (CVE-2023-37575) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the GUI's interactive VCD parsing code.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-37575 was patched at 2024-04-03, 2024-05-15
198. Remote Code Execution - Unknown Product (CVE-2023-37576) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2vzt conversion utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37576 was patched at 2024-04-03, 2024-05-15
199. Remote Code Execution - Unknown Product (CVE-2023-37577) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt2 conversion utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37577 was patched at 2024-04-03, 2024-05-15
200. Remote Code Execution - Unknown Product (CVE-2023-37578) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple use-after-free vulnerabilities exist in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the use-after-free when triggered via the vcd2lxt conversion utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37578 was patched at 2024-04-03, 2024-05-15
201. Remote Code Execution - Unknown Product (CVE-2023-37921) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2vzt conversion utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37921 was patched at 2024-04-03, 2024-05-15
202. Remote Code Execution - Unknown Product (CVE-2023-37922) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2lxt2 conversion utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37922 was patched at 2024-04-03, 2024-05-15
203. Remote Code Execution - Unknown Product (CVE-2023-37923) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2lxt conversion utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-37923 was patched at 2024-04-03, 2024-05-15
204. Remote Code Execution - Unknown Product (CVE-2023-38583) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A stack-based buffer overflow vulnerability exists in the LXT2 lxt2_rd_expand_integer_to_bits function of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-38583 was patched at 2024-04-03, 2024-05-15
205. Remote Code Execution - Unknown Product (CVE-2023-38618) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00058, EPSS Percentile is 0.23528 |
debian: CVE-2023-38618 was patched at 2024-04-03, 2024-05-15
206. Remote Code Execution - Unknown Product (CVE-2023-38619) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `msb` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00058, EPSS Percentile is 0.23528 |
debian: CVE-2023-38619 was patched at 2024-04-03, 2024-05-15
207. Remote Code Execution - Unknown Product (CVE-2023-38620) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `lsb` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00058, EPSS Percentile is 0.23528 |
debian: CVE-2023-38620 was patched at 2024-04-03, 2024-05-15
208. Remote Code Execution - Unknown Product (CVE-2023-38621) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `flags` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00058, EPSS Percentile is 0.23528 |
debian: CVE-2023-38621 was patched at 2024-04-03, 2024-05-15
209. Remote Code Execution - Unknown Product (CVE-2023-38622) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `len` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00058, EPSS Percentile is 0.23528 |
debian: CVE-2023-38622 was patched at 2024-04-03, 2024-05-15
210. Remote Code Execution - Unknown Product (CVE-2023-38623) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `vindex_offset` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00058, EPSS Percentile is 0.23528 |
debian: CVE-2023-38623 was patched at 2024-04-03, 2024-05-15
211. Remote Code Execution - Unknown Product (CVE-2023-38648) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_get_facname decompression functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the prefix copy loop.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-38648 was patched at 2024-04-03, 2024-05-15
212. Remote Code Execution - Unknown Product (CVE-2023-38649) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_get_facname decompression functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the string copy loop.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-38649 was patched at 2024-04-03, 2024-05-15
213. Remote Code Execution - Unknown Product (CVE-2023-38657) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An out-of-bounds write vulnerability exists in the LXT2 zlib block decompression functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-38657 was patched at 2024-04-03, 2024-05-15
214. Remote Code Execution - Unknown Product (CVE-2023-39234) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when looping over `lt->numrealfacs`.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-39234 was patched at 2024-04-03, 2024-05-15
215. Remote Code Execution - Unknown Product (CVE-2023-39235) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write when looping over `lt->num_time_ticks`.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21716 |
debian: CVE-2023-39235 was patched at 2024-04-03, 2024-05-15
216. Remote Code Execution - Unknown Product (CVE-2023-39270) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `rows` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00058, EPSS Percentile is 0.23528 |
debian: CVE-2023-39270 was patched at 2024-04-03, 2024-05-15
217. Remote Code Execution - Unknown Product (CVE-2023-39271) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `msb` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00058, EPSS Percentile is 0.23528 |
debian: CVE-2023-39271 was patched at 2024-04-03, 2024-05-15
218. Remote Code Execution - Unknown Product (CVE-2023-39272) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `lsb` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00058, EPSS Percentile is 0.23528 |
debian: CVE-2023-39272 was patched at 2024-04-03, 2024-05-15
219. Remote Code Execution - Unknown Product (CVE-2023-39273) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `flags` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00058, EPSS Percentile is 0.23528 |
debian: CVE-2023-39273 was patched at 2024-04-03, 2024-05-15
220. Remote Code Execution - Unknown Product (CVE-2023-39274) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `len` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00058, EPSS Percentile is 0.23528 |
debian: CVE-2023-39274 was patched at 2024-04-03, 2024-05-15
221. Remote Code Execution - Unknown Product (CVE-2023-39275) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when allocating the `value` array.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00058, EPSS Percentile is 0.23528 |
debian: CVE-2023-39275 was patched at 2024-04-03, 2024-05-15
222. Remote Code Execution - Unknown Product (CVE-2023-39443) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the prefix copy loop.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-39443 was patched at 2024-04-03, 2024-05-15
223. Remote Code Execution - Unknown Product (CVE-2023-39444) - Medium [297]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. A specially-crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the out-of-bounds write perfomed by the string copy loop.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00057, EPSS Percentile is 0.22518 |
debian: CVE-2023-39444 was patched at 2024-04-03, 2024-05-15
224. Information Disclosure - Safari (CVE-2024-23280) - Medium [293]
Description: An injection issue was addressed with improved validation. This issue is fixed in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.83 | 15 | Information Disclosure | |
0.8 | 14 | Safari is a web browser developed by Apple. It is built into Apple's operating systems, including macOS, iOS, iPadOS and their upcoming VisionOS, and uses Apple's open-source browser engine WebKit, which was derived from KHTML. | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.13257 |
debian: CVE-2024-23280 was patched at 2024-05-09, 2024-05-15
ubuntu: CVE-2024-23280 was patched at 2024-04-15
225. Command Injection - Unknown Product (CVE-2023-35959) - Medium [292]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns `.ghw` decompression.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.18192 |
debian: CVE-2023-35959 was patched at 2024-04-03, 2024-05-15
226. Command Injection - Unknown Product (CVE-2023-35960) - Medium [292]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns legacy decompression in `vcd_main`.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.18192 |
debian: CVE-2023-35960 was patched at 2024-04-03, 2024-05-15
227. Command Injection - Unknown Product (CVE-2023-35961) - Medium [292]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in `vcd_recorder_main`.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.18192 |
debian: CVE-2023-35961 was patched at 2024-04-03, 2024-05-15
228. Command Injection - Unknown Product (CVE-2023-35962) - Medium [292]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2vzt` utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.18192 |
debian: CVE-2023-35962 was patched at 2024-04-03, 2024-05-15
229. Command Injection - Unknown Product (CVE-2023-35963) - Medium [292]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2lxt2` utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.18192 |
debian: CVE-2023-35963 was patched at 2024-04-03, 2024-05-15
230. Command Injection - Unknown Product (CVE-2023-35964) - Medium [292]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns decompression in the `vcd2lxt` utility.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.18192 |
debian: CVE-2023-35964 was patched at 2024-04-03, 2024-05-15
231. Incorrect Calculation - 7-Zip (CVE-2023-31102) - Medium [291]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0.5 | 14 | KeePass is a free open source password manager, which helps you to manage your passwords in a secure way | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00048, EPSS Percentile is 0.16084 |
debian: CVE-2023-31102 was patched at 2024-05-15
redos: CVE-2023-31102 was patched at 2024-04-04
232. Information Disclosure - Unknown Product (CVE-2023-1387) - Medium [291]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Grafana is an open-source platform for monitoring and observability. \n\nStarting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. \n\nBy enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana.\n\n', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.83 | 15 | Information Disclosure | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00101, EPSS Percentile is 0.40802 |
redos: CVE-2023-1387 was patched at 2024-04-03
233. Memory Corruption - Unknown Product (CVE-2021-20236) - Medium [291]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.7 | 10 | EPSS Probability is 0.00362, EPSS Percentile is 0.72008 |
debian: CVE-2021-20236 was patched at 2024-05-15
redos: CVE-2021-20236 was patched at 2024-04-03
234. Open Redirect - Unknown Product (CVE-2022-29170) - Medium [288]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present starting with version 7.4.0-beta1 and prior to versions 7.5.16 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host) returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request security allow list is used and there is a possibility to add a custom datasource to Grafana which returns HTTP redirects. In this scenario, Grafana would blindly follow the redirects and potentially give secure information to the clients. Grafana Cloud is not impacted by this vulnerability. Versions 7.5.16 and 8.5.3 contain a patch for this issue. There are currently no known workarounds.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.75 | 15 | Open Redirect | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 8.5. According to Vulners data source | |
0.5 | 10 | EPSS Probability is 0.0014, EPSS Percentile is 0.49062 |
redos: CVE-2022-29170 was patched at 2024-04-03
235. Denial of Service - HTTP/2 (CVE-2024-30156) - Medium [286]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | HTTP/2 is a major revision of the HTTP network protocol used by the World Wide Web | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
almalinux: CVE-2024-30156 was patched at 2024-04-08
debian: CVE-2024-30156 was patched at 2024-05-15
oraclelinux: CVE-2024-30156 was patched at 2024-04-09
redhat: CVE-2024-30156 was patched at 2024-04-08, 2024-05-06, 2024-05-13, 2024-05-21, 2024-05-23, 2024-05-28
redos: CVE-2024-30156 was patched at 2024-04-23
236. Memory Corruption - GPAC (CVE-2024-22749) - Medium [286]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00063, EPSS Percentile is 0.26398 |
debian: CVE-2024-22749 was patched at 2024-05-15
redos: CVE-2024-22749 was patched at 2024-04-12
237. Denial of Service - Oracle Java SE (CVE-2024-21011) - Medium [284]
Description: Vulnerability in the Oracle
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.6 | 14 | Oracle Java SE | |
0.4 | 10 | CVSS Base Score is 3.7. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
almalinux: CVE-2024-21011 was patched at 2024-04-18, 2024-04-22
debian: CVE-2024-21011 was patched at 2024-04-22, 2024-05-15
oraclelinux: CVE-2024-21011 was patched at 2024-04-17, 2024-04-22, 2024-04-23
redhat: CVE-2024-21011 was patched at 2024-04-16, 2024-04-18, 2024-04-22
ubuntu: CVE-2024-21011 was patched at 2024-06-06
238. Denial of Service - Oracle Java SE (CVE-2024-21085) - Medium [284]
Description: Vulnerability in the Oracle
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.6 | 14 | Oracle Java SE | |
0.4 | 10 | CVSS Base Score is 3.7. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
almalinux: CVE-2024-21085 was patched at 2024-04-18, 2024-04-22
debian: CVE-2024-21085 was patched at 2024-04-22, 2024-05-15
oraclelinux: CVE-2024-21085 was patched at 2024-04-17, 2024-04-22, 2024-04-23
redhat: CVE-2024-21085 was patched at 2024-04-16, 2024-04-18, 2024-04-22
ubuntu: CVE-2024-21085 was patched at 2024-06-06
239. Path Traversal - Jenkins (CVE-2024-23900) - Medium [284]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Path Traversal | |
0.6 | 14 | Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. | |
0.4 | 10 | CVSS Base Score is 4.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.12213 |
redos: CVE-2024-23900 was patched at 2024-04-11
240. Denial of Service - Mozilla Firefox (CVE-2024-2616) - Medium [282]
Description: To harden ICU against exploitation, the behavior for out-of-memory conditions was changed
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.15491 |
almalinux: CVE-2024-2616 was patched at 2024-03-25
debian: CVE-2024-2616 was patched at 2024-03-21, 2024-05-15
oraclelinux: CVE-2024-2616 was patched at 2024-03-26
redhat: CVE-2024-2616 was patched at 2024-03-25
ubuntu: CVE-2024-2616 was patched at 2024-03-26
241. Elevation of Privilege - Unknown Product (CVE-2023-22462) - Medium [282]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Grafana is an open-source platform for monitoring and observability. On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to React's render cycle that will pass though the unsanitized HTML code, but in the next cycle the HTML is cleaned up and saved in Grafana's database. An attacker needs to have the Editor role in order to change a Text panel to include JavaScript. Another user needs to edit the same Text panel, and click on "Markdown" or "HTML" for the code to be executed. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. This issue has been patched in versions 9.2.10 and 9.3.4.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.85 | 15 | Elevation of Privilege | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.6 | 10 | EPSS Probability is 0.00243, EPSS Percentile is 0.64 |
redos: CVE-2023-22462 was patched at 2024-04-04
242. Denial of Service - TLS (CVE-2024-28835) - Medium [279]
Description: A flaw has been discovered in Gnu
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.5 | 14 | TLS | |
0.5 | 10 | CVSS Base Score is 5.0. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2024-28835 was patched at 2024-04-18, 2024-04-30
debian: CVE-2024-28835 was patched at 2024-05-15
oraclelinux: CVE-2024-28835 was patched at 2024-04-18, 2024-04-19, 2024-05-07, 2024-05-08
redhat: CVE-2024-28835 was patched at 2024-04-18, 2024-04-30, 2024-05-16
ubuntu: CVE-2024-28835 was patched at 2024-04-15, 2024-04-29
243. Memory Corruption - Unknown Product (CVE-2021-36159) - Medium [279]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\\0' terminator one byte too late.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 9.1. According to Vulners data source | |
0.7 | 10 | EPSS Probability is 0.00356, EPSS Percentile is 0.71773 |
redos: CVE-2021-36159 was patched at 2024-04-12
244. Memory Corruption - nginx (CVE-2024-24989) - Medium [279]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': '\nWhen NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.\n\nNote: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html .\n\n\n\nNOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated\n\n\n\n\n\n\n\n\n', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.5 | 14 | Nginx is an open-source web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
redos: CVE-2024-24989 was patched at 2024-04-10
245. Memory Corruption - nginx (CVE-2024-24990) - Medium [279]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': '\nWhen NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.\n\nNote: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html .\n\n\n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.5 | 14 | Nginx is an open-source web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
redos: CVE-2024-24990 was patched at 2024-04-10
246. Memory Corruption - QEMU (CVE-2023-6693) - Medium [277]
Description: A stack based
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.7 | 14 | QEMU is a generic and open source machine & userspace emulator and virtualizer | |
0.5 | 10 | CVSS Base Score is 5.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2023-6693 was patched at 2024-05-15
oraclelinux: CVE-2023-6693 was patched at 2024-04-10, 2024-05-24, 2024-06-03
redhat: CVE-2023-6693 was patched at 2024-05-22
247. Denial of Service - GPAC (CVE-2023-47465) - Medium [275]
Description: An issue in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
debian: CVE-2023-47465 was patched at 2024-05-15
redos: CVE-2023-47465 was patched at 2024-04-08
248. Unknown Vulnerability Type - Unknown Product (CVE-2023-48304) - Medium [273]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Enterprise Server, an attacker could enable and disable the birthday calendar for any user on the same server. Nextcloud Server 25.0.11, 26.0.6, and 27.1.0 and Nextcloud Enterprise Server 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 contain patches for this issue. No known workarounds are available.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0 | 15 | Unknown Vulnerability Type | |
0 | 14 | Unknown Product | |
0.4 | 10 | CVSS Base Score is 4.3. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00051, EPSS Percentile is 0.18467 |
redos: CVE-2023-48304 was patched at 2024-04-02
249. Denial of Service - Mozilla Firefox (CVE-2024-3302) - Medium [270]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10295 |
almalinux: CVE-2024-3302 was patched at 2024-04-22
debian: CVE-2024-3302 was patched at 2024-04-17, 2024-04-22, 2024-05-15
oraclelinux: CVE-2024-3302 was patched at 2024-04-22, 2024-04-23
redhat: CVE-2024-3302 was patched at 2024-04-18, 2024-04-22, 2024-04-23
ubuntu: CVE-2024-3302 was patched at 2024-04-24, 2024-04-25
250. Command Injection - Unknown Product (CVE-2024-2947) - Medium [268]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 7.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2024-2947 was patched at 2024-06-06, 2024-06-11
debian: CVE-2024-2947 was patched at 2024-04-04, 2024-05-15
oraclelinux: CVE-2024-2947 was patched at 2024-06-06, 2024-06-11
redhat: CVE-2024-2947 was patched at 2024-06-06, 2024-06-11
251. Denial of Service - Apache Tomcat (CVE-2024-23672) - Medium [265]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | Apache Tomcat is a free and open-source implementation of the Jakarta Servlet, Jakarta Expression Language, and WebSocket technologies | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.15491 |
almalinux: CVE-2024-23672 was patched at 2024-05-23, 2024-06-06
debian: CVE-2024-23672 was patched at 2024-04-17, 2024-04-19, 2024-05-15
oraclelinux: CVE-2024-23672 was patched at 2024-05-23, 2024-06-06
redhat: CVE-2024-23672 was patched at 2024-05-07, 2024-05-23, 2024-06-06, 2024-06-11
redos: CVE-2024-23672 was patched at 2024-04-22
252. Memory Corruption - TRIE (CVE-2023-40550) - Medium [255]
Description: An
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.5 | 14 | TRIE | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2023-40550 was patched at 2024-04-18
debian: CVE-2023-40550 was patched at 2024-05-15
oraclelinux: CVE-2023-40550 was patched at 2024-04-22, 2024-04-25, 2024-05-01
redhat: CVE-2023-40550 was patched at 2024-04-16, 2024-04-18, 2024-04-23, 2024-04-29
redos: CVE-2023-40550 was patched at 2024-04-11
253. Memory Corruption - Unknown Product (CVE-2023-32722) - Medium [255]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.6 | 10 | EPSS Probability is 0.00211, EPSS Percentile is 0.58655 |
debian: CVE-2023-32722 was patched at 2024-05-15
redos: CVE-2023-32722 was patched at 2024-03-29
254. Security Feature Bypass - Unknown Product (CVE-2023-1973) - Medium [255]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to BDU data source | |
0 | 10 | EPSS Probability is 0, EPSS Percentile is 0 |
redhat: CVE-2023-1973 was patched at 2024-04-04, 2024-05-08
255. Incorrect Calculation - Linux Kernel (CVE-2024-26584) - Medium [251]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tls: handle backlogging of crypto requests\n\nSince we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our\nrequests to the crypto API, crypto_aead_{encrypt,decrypt} can return\n -EBUSY instead of -EINPROGRESS in valid situations. For example, when\nthe cryptd queue for AESNI is full (easy to trigger with an\nartificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued\nto the backlog but still processed. In that case, the async callback\nwill also be called twice: first with err == -EINPROGRESS, which it\nseems we can just ignore, then with err == 0.\n\nCompared to Sabrina's original patch this version uses the new\ntls_*crypt_async_wait() helpers and converts the EBUSY to\nEINPROGRESS to avoid having to modify all the error handling\npaths. The handling is identical.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-26584 was patched at 2024-04-13, 2024-05-15
oraclelinux: CVE-2024-26584 was patched at 2024-05-02
redhat: CVE-2024-26584 was patched at 2024-04-18
ubuntu: CVE-2024-26584 was patched at 2024-06-07, 2024-06-10, 2024-06-11, 2024-06-12, 2024-06-14
256. Memory Corruption - Linux Kernel (CVE-2023-52442) - Medium [251]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate session id and tree id in compound request\n\n`smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session()\nwill always return the first request smb2 header in a compound request.\nif `SMB2_TREE_CONNECT_HE` is the first command in compound request, will\nreturn 0, i.e. The tree id check is skipped.\nThis patch use ksmbd_req_buf_next() to get current command in compound.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14408 |
debian: CVE-2023-52442 was patched at 2024-05-15
ubuntu: CVE-2023-52442 was patched at 2024-04-09, 2024-04-16
257. Memory Corruption - Linux Kernel (CVE-2023-52480) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2023-52480 was patched at 2024-05-15
ubuntu: CVE-2023-52480 was patched at 2024-04-09, 2024-04-16
258. Memory Corruption - Linux Kernel (CVE-2023-52612) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11956 |
debian: CVE-2023-52612 was patched at 2024-05-15
ubuntu: CVE-2023-52612 was patched at 2024-04-09, 2024-04-16, 2024-04-17, 2024-06-07, 2024-06-10, 2024-06-11, 2024-06-12, 2024-06-14
259. Memory Corruption - Linux Kernel (CVE-2024-26654) - Medium [251]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: sh: aica: reorder cleanup operations to avoid UAF bugs\n\nThe dreamcastcard->timer could schedule the spu_dma_work and the\nspu_dma_work could also arm the dreamcastcard->timer.\n\nWhen the snd_pcm_substream is closing, the aica_channel will be\ndeallocated. But it could still be dereferenced in the worker\nthread. The reason is that del_timer() will return directly\nregardless of whether the timer handler is running or not and\nthe worker could be rescheduled in the timer handler. As a result,\nthe UAF bug will happen. The racy situation is shown below:\n\n (Thread 1) | (Thread 2)\nsnd_aicapcm_pcm_close() |\n ... | run_spu_dma() //worker\n | mod_timer()\n flush_work() |\n del_timer() | aica_period_elapsed() //timer\n kfree(dreamcastcard->channel) | schedule_work()\n | run_spu_dma() //worker\n ... | dreamcastcard->channel-> //USE\n\nIn order to mitigate this bug and other possible corner cases,\ncall mod_timer() conditionally in run_spu_dma(), then implement\nPCM sync_stop op to cancel both the timer and worker. The sync_stop\nop will be called from PCM core appropriately when needed.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11956 |
debian: CVE-2024-26654 was patched at 2024-04-13, 2024-05-06, 2024-05-15
ubuntu: CVE-2024-26654 was patched at 2024-06-07, 2024-06-11, 2024-06-14
260. Memory Corruption - Linux Kernel (CVE-2024-26800) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-26800 was patched at 2024-04-13, 2024-05-15
261. Denial of Service - Unknown Product (CVE-2023-0437) - Medium [244]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'When calling bson_utf8_validate\xa0on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.\n\n', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
debian: CVE-2023-0437 was patched at 2024-05-15
redos: CVE-2023-0437 was patched at 2024-04-11
262. Denial of Service - Unknown Product (CVE-2024-1753) - Medium [244]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 8.6. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.09411 |
almalinux: CVE-2024-1753 was patched at 2024-04-25, 2024-04-29, 2024-04-30, 2024-05-22
debian: CVE-2024-1753 was patched at 2024-05-15
oraclelinux: CVE-2024-1753 was patched at 2024-04-25, 2024-04-29, 2024-05-07, 2024-05-29
redhat: CVE-2024-1753 was patched at 2024-04-25, 2024-04-29, 2024-04-30, 2024-05-01, 2024-05-02, 2024-05-09, 2024-05-16, 2024-05-22, 2024-05-23
redos: CVE-2024-1753 was patched at 2024-04-10, 2024-04-25
263. Memory Corruption - Unknown Product (CVE-2022-39328) - Medium [244]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patched in 9.2.4. There are no known workarounds.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 8.1. According to Vulners data source | |
0.5 | 10 | EPSS Probability is 0.00179, EPSS Percentile is 0.54552 |
redos: CVE-2022-39328 was patched at 2024-04-04
264. Memory Corruption - Unknown Product (CVE-2023-50711) - Medium [244]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the `FamStructWrapper::deserialize` implementation provided by the crate for `vmm_sys_util::fam::FamStructWrapper` can lead to out of bounds memory accesses. The deserialization does not check that the length stored in the header matches the flexible array length. Mismatch in the lengths might allow out of bounds memory access through Rust-safe methods. The issue was corrected in version 0.12.0 by inserting a check that verifies the lengths of compared flexible arrays are equal for any deserialized header and aborting deserialization otherwise. Moreover, the API was changed so that header length can only be modified through Rust-unsafe code. This ensures that users cannot trigger out-of-bounds memory access from Rust-safe code.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.3 | 10 | EPSS Probability is 0.00069, EPSS Percentile is 0.28907 |
redos: CVE-2023-50711 was patched at 2024-04-10
265. Security Feature Bypass - Unknown Product (CVE-2023-4639) - Medium [244]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 7.4. According to BDU data source | |
0 | 10 | EPSS Probability is 0, EPSS Percentile is 0 |
redhat: CVE-2023-4639 was patched at 2024-04-04, 2024-05-08
266. Cross Site Scripting - Unknown Product (CVE-2023-3010) - Medium [238]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Grafana is an open-source platform for monitoring and observability. \n\nThe WorldMap panel plugin, versions before 1.0.4 contains a DOM XSS vulnerability.\n\n', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.8 | 15 | Cross Site Scripting | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 6.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
redos: CVE-2023-3010 was patched at 2024-04-03
267. Cross Site Scripting - Unknown Product (CVE-2023-5547) - Medium [238]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'The course upload preview contained an XSS risk for users uploading unsafe data.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.8 | 15 | Cross Site Scripting | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 6.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00052, EPSS Percentile is 0.19168 |
redos: CVE-2023-5547 was patched at 2024-04-03
268. Authentication Bypass - Unknown Product (CVE-2023-48303) - Medium [234]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of user configured external storage. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for this issue. No known workarounds are available.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0 | 14 | Unknown Product | |
0.3 | 10 | CVSS Base Score is 2.7. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.19667 |
redos: CVE-2023-48303 was patched at 2024-04-02
269. Incorrect Calculation - Mozilla Firefox (CVE-2024-3859) - Medium [234]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenType font. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10295 |
almalinux: CVE-2024-3859 was patched at 2024-04-18, 2024-04-22
debian: CVE-2024-3859 was patched at 2024-04-17, 2024-04-22, 2024-05-15
oraclelinux: CVE-2024-3859 was patched at 2024-04-18, 2024-04-19
redhat: CVE-2024-3859 was patched at 2024-04-18, 2024-04-22, 2024-04-23
ubuntu: CVE-2024-3859 was patched at 2024-04-24, 2024-04-25
270. Memory Corruption - Chromium (CVE-2024-2883) - Medium [234]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2024-28834 was patched at 2024-04-11, 2024-04-18, 2024-04-30
almalinux: CVE-2024-28835 was patched at 2024-04-18, 2024-04-30
debian: CVE-2024-2883 was patched at 2024-03-28, 2024-05-15
debian: CVE-2024-28834 was patched at 2024-05-15
debian: CVE-2024-28835 was patched at 2024-05-15
oraclelinux: CVE-2024-28834 was patched at 2024-04-15, 2024-04-18, 2024-04-19, 2024-05-07, 2024-05-08
oraclelinux: CVE-2024-28835 was patched at 2024-04-18, 2024-04-19, 2024-05-07, 2024-05-08
redhat: CVE-2024-28834 was patched at 2024-04-11, 2024-04-18, 2024-04-23, 2024-04-25, 2024-04-30, 2024-05-16
redhat: CVE-2024-28835 was patched at 2024-04-18, 2024-04-30, 2024-05-16
redos: CVE-2024-2883 was patched at 2024-05-07
ubuntu: CVE-2024-28834 was patched at 2024-04-15, 2024-04-29
ubuntu: CVE-2024-28835 was patched at 2024-04-15, 2024-04-29
271. Memory Corruption - Chromium (CVE-2024-2885) - Medium [234]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-2885 was patched at 2024-03-28, 2024-05-15
redos: CVE-2024-2885 was patched at 2024-05-07
272. Memory Corruption - Chromium (CVE-2024-2886) - Medium [234]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14408 |
debian: CVE-2024-2886 was patched at 2024-03-28, 2024-05-15
redos: CVE-2024-2886 was patched at 2024-05-07
273. Memory Corruption - Chromium (CVE-2024-3157) - Medium [234]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14589 |
debian: CVE-2024-3157 was patched at 2024-04-11, 2024-05-15
redos: CVE-2024-3157 was patched at 2024-05-07
274. Memory Corruption - Chromium (CVE-2024-3515) - Medium [234]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14589 |
debian: CVE-2024-3515 was patched at 2024-04-11, 2024-05-15
redos: CVE-2024-3515 was patched at 2024-05-07
275. Memory Corruption - Chromium (CVE-2024-3516) - Medium [234]
Description: Heap
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14589 |
debian: CVE-2024-3516 was patched at 2024-04-11, 2024-05-15
redos: CVE-2024-3516 was patched at 2024-05-07
276. Memory Corruption - Mozilla Firefox (CVE-2024-29943) - Medium [234]
Description: An attacker was able to perform an
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
ubuntu: CVE-2024-29943 was patched at 2024-03-25
277. Memory Corruption - Mozilla Firefox (CVE-2024-3854) - Medium [234]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10295 |
almalinux: CVE-2024-3854 was patched at 2024-04-18, 2024-04-22
debian: CVE-2024-3854 was patched at 2024-04-17, 2024-04-22, 2024-05-15
oraclelinux: CVE-2024-3854 was patched at 2024-04-18, 2024-04-19
redhat: CVE-2024-3854 was patched at 2024-04-18, 2024-04-22, 2024-04-23
ubuntu: CVE-2024-3854 was patched at 2024-04-24, 2024-04-25
278. Memory Corruption - Mozilla Firefox (CVE-2024-3857) - Medium [234]
Description: The JIT created incorrect code for arguments in certain cases. This led to potential
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10295 |
almalinux: CVE-2024-3857 was patched at 2024-04-18, 2024-04-22
debian: CVE-2024-3857 was patched at 2024-04-17, 2024-04-22, 2024-05-15
oraclelinux: CVE-2024-3857 was patched at 2024-04-18, 2024-04-19
redhat: CVE-2024-3857 was patched at 2024-04-18, 2024-04-22, 2024-04-23
ubuntu: CVE-2024-3857 was patched at 2024-04-24, 2024-04-25
279. Memory Corruption - Mozilla Firefox (CVE-2024-3861) - Medium [234]
Description: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10295 |
almalinux: CVE-2024-3861 was patched at 2024-04-18, 2024-04-22
debian: CVE-2024-3861 was patched at 2024-04-17, 2024-04-22, 2024-05-15
oraclelinux: CVE-2024-3861 was patched at 2024-04-18, 2024-04-19
redhat: CVE-2024-3861 was patched at 2024-04-18, 2024-04-22, 2024-04-23
ubuntu: CVE-2024-3861 was patched at 2024-04-24, 2024-04-25
280. Memory Corruption - Mozilla Firefox (CVE-2024-3864) - Medium [234]
Description: Memory safety bug present in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10295 |
almalinux: CVE-2024-3864 was patched at 2024-04-18, 2024-04-22
debian: CVE-2024-3864 was patched at 2024-04-17, 2024-04-22, 2024-05-15
oraclelinux: CVE-2024-3864 was patched at 2024-04-18, 2024-04-19
redhat: CVE-2024-3864 was patched at 2024-04-18, 2024-04-22, 2024-04-23
ubuntu: CVE-2024-3864 was patched at 2024-04-24, 2024-04-25
281. Unknown Vulnerability Type - GitLab (CVE-2024-23903) - Medium [233]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook token.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | GitLab is a DevOps software package that combines the ability to develop, secure, and operate software in a single application | |
0.5 | 10 | CVSS Base Score is 5.3. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
redos: CVE-2024-23903 was patched at 2024-04-11
282. Unknown Vulnerability Type - Linux Kernel (CVE-2023-52429) - Medium [233]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
debian: CVE-2023-52429 was patched at 2024-05-06, 2024-05-15
ubuntu: CVE-2023-52429 was patched at 2024-04-09, 2024-04-16, 2024-04-17, 2024-04-19
283. Unknown Vulnerability Type - Linux Kernel (CVE-2024-29018) - Medium [233]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature is frequently referred to as custom networks, as each network can have a different driver, set of parameters and thus behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_. The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and other API clients may specify the `internal` parameter as well.\n\nWhen containers with networking are created, they are assigned unique network interfaces and IP addresses. The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs.\n\nContainers on an internal network may communicate between each other, but are precluded from communicating with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately configured host services) is possible, and the host may communicate with any container IP directly.\n\nIn addition to configuring the Linux kernel's various networking features to enable container networking, `dockerd` directly provides some services to container networks. Principal among these is serving as a resolver, enabling service discovery, and resolution of names from an upstream resolver.\n\nWhen a DNS request for a name that does not correspond to a container is received, the request is forwarded to the configured upstream resolver. This request is made from the container's network namespace: the level of access and routing of traffic is the same as if the request was made by the container itself.\n\nAs a consequence of this design, containers solely attached to an internal network will be unable to resolve names using the upstream resolver, as the container itself is unable to communicate with that nameserver. Only the names of containers also attached to the internal network are able to be resolved.\n\nMany systems run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a consequence of the design described above is that containers are unable to resolve names from the host's configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as expected.\n\nBecause `dockerd` forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that will eventually be answered by their nameservers.\n\nDocker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.\n\nMoby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run containers intended to be solely attached to internal networks with a custom upstream address, which will force all upstream DNS queries to be resolved from the container's network namespace.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.9. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
debian: CVE-2024-29018 was patched at 2024-05-15
redos: CVE-2024-29018 was patched at 2024-04-10
284. Denial of Service - Unknown Product (CVE-2023-4822) - Medium [232]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations.\n\nIt also allows an Organization Admin to assign or revoke any permissions that they have to any user globally.\n\nThis means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user.\n\nThe vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.\n\n', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 7.2. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.17766 |
redos: CVE-2023-4822 was patched at 2024-04-03
285. Security Feature Bypass - Unknown Product (CVE-2023-32721) - Medium [232]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.13053 |
debian: CVE-2023-32721 was patched at 2024-05-15
redos: CVE-2023-32721 was patched at 2024-03-29
286. Unknown Vulnerability Type - Node.js (CVE-2024-22017) - Medium [228]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().\nThis allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().\nThis vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.8 | 14 | Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more | |
0.7 | 10 | CVSS Base Score is 7.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
almalinux: CVE-2024-22017 was patched at 2024-04-08
oraclelinux: CVE-2024-22017 was patched at 2024-04-08
redhat: CVE-2024-22017 was patched at 2024-04-08
287. Cross Site Scripting - Unknown Product (CVE-2023-48302) - Medium [226]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTML code without markup (Ctrl+Shift+V) the markup will actually render. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.13, 26.0.8, and 27.1.3 contain a fix for this issue. As a workaround, disable app text.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.8 | 15 | Cross Site Scripting | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.19667 |
redos: CVE-2023-48302 was patched at 2024-04-02
288. Cross Site Scripting - Unknown Product (CVE-2023-5544) - Medium [226]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.8 | 15 | Cross Site Scripting | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.4. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.19667 |
redos: CVE-2023-5544 was patched at 2024-04-03
289. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26585) - Medium [221]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix race between tx work scheduling and socket close\n\nSimilarly to previous commit, the submitting thread (recvmsg/sendmsg)\nmay exit as soon as the async crypto handler calls complete().\nReorder scheduling the work before calling complete().\nThis seems more logical in the first place, as it's\nthe inverse order of what the submitting thread will do.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.5 | 10 | CVSS Base Score is 4.7. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
debian: CVE-2024-26585 was patched at 2024-04-13, 2024-05-15
oraclelinux: CVE-2024-26585 was patched at 2024-05-02
ubuntu: CVE-2024-26585 was patched at 2024-06-07, 2024-06-10, 2024-06-11, 2024-06-12, 2024-06-14
290. Unknown Vulnerability Type - Jenkins (CVE-2023-43498) - Medium [219]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the default system temporary directory with the default permissions for newly created files, potentially allowing attackers with access to the Jenkins controller file system to read and write the files before they are used.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.6 | 14 | Jenkins is an open source automation server. It helps automate the parts of software development related to building, testing, and deploying, facilitating continuous integration, and continuous delivery. | |
0.8 | 10 | CVSS Base Score is 8.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.17886 |
redos: CVE-2023-43498 was patched at 2024-04-11
291. Memory Corruption - QEMU (CVE-2024-24474) - Medium [217]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.7 | 14 | QEMU is a generic and open source machine & userspace emulator and virtualizer | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-24474 was patched at 2024-05-15
oraclelinux: CVE-2024-24474 was patched at 2024-04-10, 2024-06-03
redos: CVE-2024-24474 was patched at 2024-04-23
292. Spoofing - Safari (CVE-2023-42843) - Medium [216]
Description: An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1,
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.4 | 15 | Spoofing | |
0.8 | 14 | Safari is a web browser developed by Apple. It is built into Apple's operating systems, including macOS, iOS, iPadOS and their upcoming VisionOS, and uses Apple's open-source browser engine WebKit, which was derived from KHTML. | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2023-42843 was patched at 2024-05-09, 2024-05-15
ubuntu: CVE-2023-42843 was patched at 2024-04-15
293. Denial of Service - Unknown Product (CVE-2023-40549) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and crashing Shim, resulting in a denial of service.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
almalinux: CVE-2023-40549 was patched at 2024-04-18
debian: CVE-2023-40549 was patched at 2024-05-15
oraclelinux: CVE-2023-40549 was patched at 2024-04-22, 2024-04-25, 2024-05-01
redhat: CVE-2023-40549 was patched at 2024-04-16, 2024-04-18, 2024-04-23, 2024-04-29
redos: CVE-2023-40549 was patched at 2024-04-11
294. Denial of Service - Unknown Product (CVE-2024-24246) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-24246 was patched at 2024-05-15
ubuntu: CVE-2024-24246 was patched at 2024-03-25
295. Incorrect Calculation - Unknown Product (CVE-2023-35057) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An integer overflow vulnerability exists in the LXT2 lxt2_rd_trace value elements allocation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.20112 |
debian: CVE-2023-35057 was patched at 2024-04-03, 2024-05-15
296. Incorrect Calculation - Unknown Product (CVE-2023-35128) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An integer overflow vulnerability exists in the fstReaderIterBlocks2 time_table tsec_nitems functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.20112 |
debian: CVE-2023-35128 was patched at 2024-04-03, 2024-05-15
297. Incorrect Calculation - Unknown Product (CVE-2023-35992) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An integer overflow vulnerability exists in the FST fstReaderIterBlocks2 vesc allocation functionality of GTKWave 3.3.115, when compiled as a 32-bit binary. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.20112 |
debian: CVE-2023-35992 was patched at 2024-04-03, 2024-05-15
298. Incorrect Calculation - Unknown Product (CVE-2023-38650) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode times parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is not zero.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.21725 |
debian: CVE-2023-38650 was patched at 2024-04-03, 2024-05-15
299. Incorrect Calculation - Unknown Product (CVE-2023-38651) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode times parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is zero.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.21725 |
debian: CVE-2023-38651 was patched at 2024-04-03, 2024-05-15
300. Incorrect Calculation - Unknown Product (CVE-2023-38652) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode dict parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is not zero.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.21725 |
debian: CVE-2023-38652 was patched at 2024-04-03, 2024-05-15
301. Incorrect Calculation - Unknown Product (CVE-2023-38653) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer overflow vulnerabilities exist in the VZT vzt_rd_block_vch_decode dict parsing functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer overflow when num_time_ticks is zero.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.21725 |
debian: CVE-2023-38653 was patched at 2024-04-03, 2024-05-15
302. Memory Corruption - Unknown Product (CVE-2023-32726) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 8.1. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00061, EPSS Percentile is 0.24996 |
debian: CVE-2023-32726 was patched at 2024-05-15
redos: CVE-2023-32726 was patched at 2024-03-28
303. Memory Corruption - Unknown Product (CVE-2023-36746) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the handling of `len` in `fstWritex` when parsing the time table.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00055, EPSS Percentile is 0.21464 |
debian: CVE-2023-36746 was patched at 2024-04-03, 2024-05-15
304. Memory Corruption - Unknown Product (CVE-2023-36747) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the handling of `len` in `fstWritex` when `beg_time` does not match the start of the time table.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.20112 |
debian: CVE-2023-36747 was patched at 2024-04-03, 2024-05-15
305. Memory Corruption - Unknown Product (CVE-2023-39413) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer underflow when performing the left shift operation.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.20112 |
debian: CVE-2023-39413 was patched at 2024-04-03, 2024-05-15
306. Memory Corruption - Unknown Product (CVE-2023-46045) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.19687 |
debian: CVE-2023-46045 was patched at 2024-05-15
ubuntu: CVE-2023-46045 was patched at 2024-03-21
307. Memory Corruption - Unknown Product (CVE-2024-23327) - Medium [208]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15511 |
oraclelinux: CVE-2024-23327 was patched at 2024-04-16, 2024-04-26
redos: CVE-2024-23327 was patched at 2024-04-23
308. Unknown Vulnerability Type - Node.js (CVE-2024-21890) - Medium [204]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example:\n```\n --allow-fs-read=/home/node/.ssh/*.pub\n```\n\nwill ignore `pub` and give access to everything after `.ssh/`.\n\nThis misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.8 | 14 | Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more | |
0.5 | 10 | CVSS Base Score is 5.0. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
almalinux: CVE-2024-21890 was patched at 2024-04-08
oraclelinux: CVE-2024-21890 was patched at 2024-04-08
redhat: CVE-2024-21890 was patched at 2024-04-08
309. Denial of Service - Unknown Product (CVE-2023-40551) - Low [196]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.1. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05271 |
almalinux: CVE-2023-40551 was patched at 2024-04-18
debian: CVE-2023-40551 was patched at 2024-05-15
oraclelinux: CVE-2023-40551 was patched at 2024-04-22, 2024-04-25, 2024-05-01
redhat: CVE-2023-40551 was patched at 2024-04-16, 2024-04-18, 2024-04-23, 2024-04-29
redos: CVE-2023-40551 was patched at 2024-04-11
310. Denial of Service - Unknown Product (CVE-2024-2496) - Low [196]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.0. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2024-2496 was patched at 2024-04-30
debian: CVE-2024-2496 was patched at 2024-05-15
oraclelinux: CVE-2024-2496 was patched at 2024-05-03
redhat: CVE-2024-2496 was patched at 2024-04-30
redos: CVE-2024-2496 was patched at 2024-04-23
ubuntu: CVE-2024-2496 was patched at 2024-04-15
311. Memory Corruption - Unknown Product (CVE-2023-40548) - Low [196]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes memory corruption and can lead to a crash or data integrity issues during the boot phase.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 7.4. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.0005, EPSS Percentile is 0.18166 |
almalinux: CVE-2023-40548 was patched at 2024-04-18
debian: CVE-2023-40548 was patched at 2024-05-15
oraclelinux: CVE-2023-40548 was patched at 2024-04-22, 2024-04-25, 2024-05-01
redhat: CVE-2023-40548 was patched at 2024-04-16, 2024-04-18, 2024-04-23, 2024-04-29
redos: CVE-2023-40548 was patched at 2024-04-11
312. Information Disclosure - Unknown Product (CVE-2023-5551) - Low [195]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.83 | 15 | Information Disclosure | |
0 | 14 | Unknown Product | |
0.3 | 10 | CVSS Base Score is 3.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
redos: CVE-2023-5551 was patched at 2024-04-03
313. Unknown Vulnerability Type - Perl (CVE-2024-1132) - Low [195]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.6 | 14 | Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages | |
0.8 | 10 | CVSS Base Score is 8.1. According to Vulners data source | |
0 | 10 | EPSS Probability is 0, EPSS Percentile is 0 |
redhat: CVE-2024-1132 was patched at 2024-04-16
314. Memory Corruption - Unknown Product (CVE-2023-39414) - Low [184]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Multiple integer underflow vulnerabilities exist in the LXT2 lxt2_rd_iter_radix shift operation functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to memory corruption. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the integer underflow when performing the right shift operation.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 7.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
debian: CVE-2023-39414 was patched at 2024-04-03, 2024-05-15
315. Memory Corruption - Unknown Product (CVE-2024-31080) - Low [184]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 7.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2024-31080 was patched at 2024-04-24, 2024-04-30, 2024-05-22, 2024-05-23
debian: CVE-2024-31080 was patched at 2024-04-12, 2024-05-15
oraclelinux: CVE-2024-31080 was patched at 2024-04-11, 2024-04-24, 2024-04-29, 2024-05-07, 2024-05-29
redhat: CVE-2024-31080 was patched at 2024-04-11, 2024-04-24, 2024-04-29, 2024-04-30, 2024-05-22, 2024-05-23
redos: CVE-2024-31080 was patched at 2024-05-07
ubuntu: CVE-2024-31080 was patched at 2024-04-04
316. Memory Corruption - Unknown Product (CVE-2024-31081) - Low [184]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 7.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2024-31081 was patched at 2024-04-24, 2024-04-30, 2024-05-22, 2024-05-23
debian: CVE-2024-31081 was patched at 2024-04-12, 2024-05-15
oraclelinux: CVE-2024-31081 was patched at 2024-04-11, 2024-04-24, 2024-04-29, 2024-05-07, 2024-05-29
redhat: CVE-2024-31081 was patched at 2024-04-11, 2024-04-24, 2024-04-29, 2024-04-30, 2024-05-22, 2024-05-23
redos: CVE-2024-31081 was patched at 2024-05-07
ubuntu: CVE-2024-31081 was patched at 2024-04-04
317. Memory Corruption - Unknown Product (CVE-2024-31082) - Low [184]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 7.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
debian: CVE-2024-31082 was patched at 2024-05-15
redos: CVE-2024-31082 was patched at 2024-05-07
ubuntu: CVE-2024-31082 was patched at 2024-04-04
318. Unknown Vulnerability Type - MediaWiki (CVE-2023-45369) - Low [176]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of hidden users are exposed.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.7 | 14 | MediaWiki is a free server-based wiki software, licensed under the GNU General Public License (GPL) | |
0.4 | 10 | CVSS Base Score is 4.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.13053 |
redos: CVE-2023-45369 was patched at 2024-04-05
319. Unknown Vulnerability Type - Unknown Product (CVE-2023-30801) - Low [166]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.\n', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0 | 14 | Unknown Product | |
1.0 | 10 | CVSS Base Score is 9.8. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00116, EPSS Percentile is 0.44849 |
debian: CVE-2023-30801 was patched at 2024-05-15
redos: CVE-2023-30801 was patched at 2024-04-05
320. Unknown Vulnerability Type - Apache HTTP Server (CVE-2023-38709) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.\n\nThis issue affects Apache HTTP Server: through 2.4.58.\n', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | Apache HTTP Server is a free and open-source web server that delivers web content through the internet | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
debian: CVE-2023-38709 was patched at 2024-04-16, 2024-05-15
ubuntu: CVE-2023-38709 was patched at 2024-04-11, 2024-04-17, 2024-04-29
321. Unknown Vulnerability Type - Apache HTTP Server (CVE-2024-24795) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.\n\nUsers are recommended to upgrade to version 2.4.59, which fixes this issue.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | Apache HTTP Server is a free and open-source web server that delivers web content through the internet | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.0816 |
debian: CVE-2024-24795 was patched at 2024-04-16, 2024-05-15
ubuntu: CVE-2024-24795 was patched at 2024-04-11, 2024-04-17, 2024-04-29
322. Unknown Vulnerability Type - Linux Kernel (CVE-2023-52609) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix race between mmput() and do_exit()\n\nTask A calls binder_update_page_range() to allocate and insert pages on\na remote address space from Task B. For this, Task A pins the remote mm\nvia mmget_not_zero() first. This can race with Task B do_exit() and the\nfinal mmput() refcount decrement will come from Task A.\n\n Task A | Task B\n ------------------+------------------\n mmget_not_zero() |\n | do_exit()\n | exit_mm()\n | mmput()\n mmput() |\n exit_mmap() |\n remove_vma() |\n fput() |\n\nIn this case, the work of ____fput() from Task B is queued up in Task A\nas TWA_RESUME. So in theory, Task A returns to userspace and the cleanup\nwork gets executed. However, Task A instead sleep, waiting for a reply\nfrom Task B that never comes (it's dead).\n\nThis means the binder_deferred_release() is blocked until an unrelated\nbinder event forces Task A to go back to userspace. All the associated\ndeath notifications will also be delayed until then.\n\nIn order to fix this use mmput_async() that will schedule the work in\nthe corresponding mm->async_put_work WQ instead of Task A.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11956 |
debian: CVE-2023-52609 was patched at 2024-05-15
ubuntu: CVE-2023-52609 was patched at 2024-04-09, 2024-04-16, 2024-04-17, 2024-06-07, 2024-06-10, 2024-06-11, 2024-06-12, 2024-06-14
323. Unknown Vulnerability Type - Linux Kernel (CVE-2023-52610) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix skb leak and crash on ooo frags\n\nact_ct adds skb->users before defragmentation. If frags arrive in order,\nthe last frag's reference is reset in:\n\n inet_frag_reasm_prepare\n skb_morph\n\nwhich is not straightforward.\n\nHowever when frags arrive out of order, nobody unref the last frag, and\nall frags are leaked. The situation is even worse, as initiating packet\ncapture can lead to a crash[0] when skb has been cloned and shared at the\nsame time.\n\nFix the issue by removing skb_get() before defragmentation. act_ct\nreturns TC_ACT_CONSUMED when defrag failed or in progress.\n\n[0]:\n[ 843.804823] ------------[ cut here ]------------\n[ 843.809659] kernel BUG at net/core/skbuff.c:2091!\n[ 843.814516] invalid opcode: 0000 [#1] PREEMPT SMP\n[ 843.819296] CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G S 6.7.0-rc3 #2\n[ 843.824107] Hardware name: XFUSION 1288H V6/BC13MBSBD, BIOS 1.29 11/25/2022\n[ 843.828953] RIP: 0010:pskb_expand_head+0x2ac/0x300\n[ 843.833805] Code: 8b 70 28 48 85 f6 74 82 48 83 c6 08 bf 01 00 00 00 e8 38 bd ff ff 8b 83 c0 00 00 00 48 03 83 c8 00 00 00 e9 62 ff ff ff 0f 0b <0f> 0b e8 8d d0 ff ff e9 b3 fd ff ff 81 7c 24 14 40 01 00 00 4c 89\n[ 843.843698] RSP: 0018:ffffc9000cce07c0 EFLAGS: 00010202\n[ 843.848524] RAX: 0000000000000002 RBX: ffff88811a211d00 RCX: 0000000000000820\n[ 843.853299] RDX: 0000000000000640 RSI: 0000000000000000 RDI: ffff88811a211d00\n[ 843.857974] RBP: ffff888127d39518 R08: 00000000bee97314 R09: 0000000000000000\n[ 843.862584] R10: 0000000000000000 R11: ffff8881109f0000 R12: 0000000000000880\n[ 843.867147] R13: ffff888127d39580 R14: 0000000000000640 R15: ffff888170f7b900\n[ 843.871680] FS: 0000000000000000(0000) GS:ffff889ffffc0000(0000) knlGS:0000000000000000\n[ 843.876242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 843.880778] CR2: 00007fa42affcfb8 CR3: 000000011433a002 CR4: 0000000000770ef0\n[ 843.885336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 843.889809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 843.894229] PKRU: 55555554\n[ 843.898539] Call Trace:\n[ 843.902772] <IRQ>\n[ 843.906922] ? __die_body+0x1e/0x60\n[ 843.911032] ? die+0x3c/0x60\n[ 843.915037] ? do_trap+0xe2/0x110\n[ 843.918911] ? pskb_expand_head+0x2ac/0x300\n[ 843.922687] ? do_error_trap+0x65/0x80\n[ 843.926342] ? pskb_expand_head+0x2ac/0x300\n[ 843.929905] ? exc_invalid_op+0x50/0x60\n[ 843.933398] ? pskb_expand_head+0x2ac/0x300\n[ 843.936835] ? asm_exc_invalid_op+0x1a/0x20\n[ 843.940226] ? pskb_expand_head+0x2ac/0x300\n[ 843.943580] inet_frag_reasm_prepare+0xd1/0x240\n[ 843.946904] ip_defrag+0x5d4/0x870\n[ 843.950132] nf_ct_handle_fragments+0xec/0x130 [nf_conntrack]\n[ 843.953334] tcf_ct_act+0x252/0xd90 [act_ct]\n[ 843.956473] ? tcf_mirred_act+0x516/0x5a0 [act_mirred]\n[ 843.959657] tcf_action_exec+0xa1/0x160\n[ 843.962823] fl_classify+0x1db/0x1f0 [cls_flower]\n[ 843.966010] ? skb_clone+0x53/0xc0\n[ 843.969173] tcf_classify+0x24d/0x420\n[ 843.972333] tc_run+0x8f/0xf0\n[ 843.975465] __netif_receive_skb_core+0x67a/0x1080\n[ 843.978634] ? dev_gro_receive+0x249/0x730\n[ 843.981759] __netif_receive_skb_list_core+0x12d/0x260\n[ 843.984869] netif_receive_skb_list_internal+0x1cb/0x2f0\n[ 843.987957] ? mlx5e_handle_rx_cqe_mpwrq_rep+0xfa/0x1a0 [mlx5_core]\n[ 843.991170] napi_complete_done+0x72/0x1a0\n[ 843.994305] mlx5e_napi_poll+0x28c/0x6d0 [mlx5_core]\n[ 843.997501] __napi_poll+0x25/0x1b0\n[ 844.000627] net_rx_action+0x256/0x330\n[ 844.003705] __do_softirq+0xb3/0x29b\n[ 844.006718] irq_exit_rcu+0x9e/0xc0\n[ 844.009672] common_interrupt+0x86/0xa0\n[ 844.012537] </IRQ>\n[ 844.015285] <TASK>\n[ 844.017937] asm_common_interrupt+0x26/0x40\n[ 844.020591] RIP: 0010:acpi_safe_halt+0x1b/0x20\n[ 844.023247] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 65 48 8b 04 25 00 18 03 00 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 81 d0 44 00 fb\n---truncated---', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2023-52610 was patched at 2024-06-05
debian: CVE-2023-52610 was patched at 2024-05-15
oraclelinux: CVE-2023-52610 was patched at 2024-05-02, 2024-06-05
redhat: CVE-2023-52610 was patched at 2024-06-05
ubuntu: CVE-2023-52610 was patched at 2024-04-09, 2024-04-16, 2024-06-07, 2024-06-10, 2024-06-11, 2024-06-12, 2024-06-14
324. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26631) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work\n\nidev->mc_ifc_count can be written over without proper locking.\n\nOriginally found by syzbot [1], fix this issue by encapsulating calls\nto mld_ifc_stop_work() (and mld_gq_stop_work() for good measure) with\nmutex_lock() and mutex_unlock() accordingly as these functions\nshould only be called with mc_lock per their declarations.\n\n[1]\nBUG: KCSAN: data-race in ipv6_mc_down / mld_ifc_work\n\nwrite to 0xffff88813a80c832 of 1 bytes by task 3771 on cpu 0:\n mld_ifc_stop_work net/ipv6/mcast.c:1080 [inline]\n ipv6_mc_down+0x10a/0x280 net/ipv6/mcast.c:2725\n addrconf_ifdown+0xe32/0xf10 net/ipv6/addrconf.c:3949\n addrconf_notify+0x310/0x980\n notifier_call_chain kernel/notifier.c:93 [inline]\n raw_notifier_call_chain+0x6b/0x1c0 kernel/notifier.c:461\n __dev_notify_flags+0x205/0x3d0\n dev_change_flags+0xab/0xd0 net/core/dev.c:8685\n do_setlink+0x9f6/0x2430 net/core/rtnetlink.c:2916\n rtnl_group_changelink net/core/rtnetlink.c:3458 [inline]\n __rtnl_newlink net/core/rtnetlink.c:3717 [inline]\n rtnl_newlink+0xbb3/0x1670 net/core/rtnetlink.c:3754\n rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6558\n netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2545\n rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6576\n netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]\n netlink_unicast+0x589/0x650 net/netlink/af_netlink.c:1368\n netlink_sendmsg+0x66e/0x770 net/netlink/af_netlink.c:1910\n ...\n\nwrite to 0xffff88813a80c832 of 1 bytes by task 22 on cpu 1:\n mld_ifc_work+0x54c/0x7b0 net/ipv6/mcast.c:2653\n process_one_work kernel/workqueue.c:2627 [inline]\n process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2700\n worker_thread+0x525/0x730 kernel/workqueue.c:2781\n ...', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-26631 was patched at 2024-05-15
ubuntu: CVE-2024-26631 was patched at 2024-04-09, 2024-04-16, 2024-06-07, 2024-06-10, 2024-06-11, 2024-06-12, 2024-06-14
325. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26633) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()\n\nsyzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.\n\nReading frag_off can only be done if we pulled enough bytes\nto skb->head. Currently we might access garbage.\n\n[1]\nBUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\nip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\nxmit_one net/core/dev.c:3548 [inline]\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\nneigh_output include/net/neighbour.h:542 [inline]\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\ndst_output include/net/dst.h:451 [inline]\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg net/socket.c:745 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n__sys_sendmsg net/socket.c:2667 [inline]\n__do_sys_sendmsg net/socket.c:2676 [inline]\n__se_sys_sendmsg net/socket.c:2674 [inline]\n__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\nslab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\nslab_alloc_node mm/slub.c:3478 [inline]\n__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517\n__do_kmalloc_node mm/slab_common.c:1006 [inline]\n__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027\nkmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582\npskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098\n__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655\npskb_may_pull_reason include/linux/skbuff.h:2673 [inline]\npskb_may_pull include/linux/skbuff.h:2681 [inline]\nip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\nxmit_one net/core/dev.c:3548 [inline]\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\nneigh_output include/net/neighbour.h:542 [inline]\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\ndst_output include/net/dst.h:451 [inline]\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg net/socket.c:745 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n__sys_sendmsg net/socket.c:2667 [inline]\n__do_sys_sendms\n---truncated---', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11956 |
debian: CVE-2024-26633 was patched at 2024-05-15
oraclelinux: CVE-2024-26633 was patched at 2024-05-02
ubuntu: CVE-2024-26633 was patched at 2024-04-09, 2024-04-16, 2024-04-17, 2024-06-07, 2024-06-10, 2024-06-11, 2024-06-12, 2024-06-14
326. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26642) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: disallow anonymous set with timeout flag\n\nAnonymous sets are never used with timeout from userspace, reject this.\nException to this rule is NFT_SET_EVAL to ensure legacy meters still work.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11956 |
almalinux: CVE-2024-26642 was patched at 2024-06-05
debian: CVE-2024-26642 was patched at 2024-04-13, 2024-05-06, 2024-05-15
oraclelinux: CVE-2024-26642 was patched at 2024-05-23, 2024-06-05
redhat: CVE-2024-26642 was patched at 2024-05-29, 2024-06-05, 2024-06-11
327. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26643) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout\n\nWhile the rhashtable set gc runs asynchronously, a race allows it to\ncollect elements from anonymous sets with timeouts while it is being\nreleased from the commit path.\n\nMingi Cho originally reported this issue in a different path in 6.1.x\nwith a pipapo set with low timeouts which is not possible upstream since\n7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set\nelement timeout").\n\nFix this by setting on the dead flag for anonymous sets to skip async gc\nin this case.\n\nAccording to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on\ntransaction abort"), Florian plans to accelerate abort path by releasing\nobjects via workqueue, therefore, this sets on the dead flag for abort\npath too.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.09411 |
almalinux: CVE-2024-26643 was patched at 2024-06-05
debian: CVE-2024-26643 was patched at 2024-04-13, 2024-05-06, 2024-05-15
oraclelinux: CVE-2024-26643 was patched at 2024-05-23, 2024-06-05
redhat: CVE-2024-26643 was patched at 2024-05-29, 2024-06-05
328. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26809) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo: release elements in clone only from destroy path\n\nClone already always provides a current view of the lookup table, use it\nto destroy the set, otherwise it is possible to destroy elements twice.\n\nThis fix requires:\n\n 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")\n\nwhich came after:\n\n 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path").', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.09411 |
debian: CVE-2024-26809 was patched at 2024-04-13, 2024-05-06, 2024-05-15
ubuntu: CVE-2024-26809 was patched at 2024-06-07, 2024-06-10, 2024-06-11, 2024-06-14
329. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26810) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Lock external INTx masking ops\n\nMask operations through config space changes to DisINTx may race INTx\nconfiguration changes via ioctl. Create wrappers that add locking for\npaths outside of the core interrupt code.\n\nIn particular, irq_type is updated holding igate, therefore testing\nis_intx() requires holding igate. For example clearing DisINTx from\nconfig space can otherwise race changes of the interrupt configuration.\n\nThis aligns interfaces which may trigger the INTx eventfd into two\ncamps, one side serialized by igate and the other only enabled while\nINTx is configured. A subsequent patch introduces synchronization for\nthe latter flows.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11956 |
debian: CVE-2024-26810 was patched at 2024-04-13, 2024-05-06, 2024-05-15
ubuntu: CVE-2024-26810 was patched at 2024-06-07, 2024-06-11, 2024-06-14
330. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26811) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate payload size in ipc response\n\nIf installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc\nresponse to ksmbd kernel server. ksmbd should validate payload size of\nipc response from ksmbd.mountd to avoid memory overrun or\nslab-out-of-bounds. This patch validate 3 ipc response that has payload.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.09411 |
debian: CVE-2024-26811 was patched at 2024-04-13, 2024-05-15
331. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26812) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Create persistent INTx handler\n\nA vulnerability exists where the eventfd for INTx signaling can be\ndeconfigured, which unregisters the IRQ handler but still allows\neventfds to be signaled with a NULL context through the SET_IRQS ioctl\nor through unmask irqfd if the device interrupt is pending.\n\nIdeally this could be solved with some additional locking; the igate\nmutex serializes the ioctl and config space accesses, and the interrupt\nhandler is unregistered relative to the trigger, but the irqfd path\nruns asynchronous to those. The igate mutex cannot be acquired from the\natomic context of the eventfd wake function. Disabling the irqfd\nrelative to the eventfd registration is potentially incompatible with\nexisting userspace.\n\nAs a result, the solution implemented here moves configuration of the\nINTx interrupt handler to track the lifetime of the INTx context object\nand irq_type configuration, rather than registration of a particular\ntrigger eventfd. Synchronization is added between the ioctl path and\neventfd_signal() wrapper such that the eventfd trigger can be\ndynamically updated relative to in-flight interrupts or irqfd callbacks.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11956 |
debian: CVE-2024-26812 was patched at 2024-04-13, 2024-05-06, 2024-05-15
ubuntu: CVE-2024-26812 was patched at 2024-06-07, 2024-06-11, 2024-06-14
332. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26813) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/platform: Create persistent IRQ handlers\n\nThe vfio-platform SET_IRQS ioctl currently allows loopback triggering of\nan interrupt before a signaling eventfd has been configured by the user,\nwhich thereby allows a NULL pointer dereference.\n\nRather than register the IRQ relative to a valid trigger, register all\nIRQs in a disabled state in the device open path. This allows mask\noperations on the IRQ to nest within the overall enable state governed\nby a valid eventfd signal. This decouples @masked, protected by the\n@locked spinlock from @trigger, protected via the @igate mutex.\n\nIn doing so, it's guaranteed that changes to @trigger cannot race the\nIRQ handlers because the IRQ handler is synchronously disabled before\nmodifying the trigger, and loopback triggering of the IRQ via ioctl is\nsafe due to serialization with trigger changes via igate.\n\nFor compatibility, request_irq() failures are maintained to be local to\nthe SET_IRQS ioctl rather than a fatal error in the open device path.\nThis allows, for example, a userspace driver with polling mode support\nto continue to work regardless of moving the request_irq() call site.\nThis necessarily blocks all SET_IRQS access to the failed index.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11956 |
debian: CVE-2024-26813 was patched at 2024-04-13, 2024-05-06, 2024-05-15
ubuntu: CVE-2024-26813 was patched at 2024-06-07, 2024-06-11, 2024-06-14
333. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26814) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/fsl-mc: Block calling interrupt handler without trigger\n\nThe eventfd_ctx trigger pointer of the vfio_fsl_mc_irq object is\ninitially NULL and may become NULL if the user sets the trigger\neventfd to -1. The interrupt handler itself is guaranteed that\ntrigger is always valid between request_irq() and free_irq(), but\nthe loopback testing mechanisms to invoke the handler function\nneed to test the trigger. The triggering and setting ioctl paths\nboth make use of igate and are therefore mutually exclusive.\n\nThe vfio-fsl-mc driver does not make use of irqfds, nor does it\nsupport any sort of masking operations, therefore unlike vfio-pci\nand vfio-platform, the flow can remain essentially unchanged.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.09411 |
debian: CVE-2024-26814 was patched at 2024-04-13, 2024-05-06, 2024-05-15
ubuntu: CVE-2024-26814 was patched at 2024-06-07, 2024-06-11, 2024-06-14
334. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26815) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check\n\ntaprio_parse_tc_entry() is not correctly checking\nTCA_TAPRIO_TC_ENTRY_INDEX attribute:\n\n\tint tc; // Signed value\n\n\ttc = nla_get_u32(tb[TCA_TAPRIO_TC_ENTRY_INDEX]);\n\tif (tc >= TC_QOPT_MAX_QUEUE) {\n\t\tNL_SET_ERR_MSG_MOD(extack, "TC entry index out of range");\n\t\treturn -ERANGE;\n\t}\n\nsyzbot reported that it could fed arbitary negative values:\n\nUBSAN: shift-out-of-bounds in net/sched/sch_taprio.c:1722:18\nshift exponent -2147418108 is negative\nCPU: 0 PID: 5066 Comm: syz-executor367 Not tainted 6.8.0-rc7-syzkaller-00136-gc8a5c731fd12 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:217 [inline]\n __ubsan_handle_shift_out_of_bounds+0x3c7/0x420 lib/ubsan.c:386\n taprio_parse_tc_entry net/sched/sch_taprio.c:1722 [inline]\n taprio_parse_tc_entries net/sched/sch_taprio.c:1768 [inline]\n taprio_change+0xb87/0x57d0 net/sched/sch_taprio.c:1877\n taprio_init+0x9da/0xc80 net/sched/sch_taprio.c:2134\n qdisc_create+0x9d4/0x1190 net/sched/sch_api.c:1355\n tc_modify_qdisc+0xa26/0x1e40 net/sched/sch_api.c:1776\n rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6617\n netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x221/0x270 net/socket.c:745\n ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n ___sys_sendmsg net/socket.c:2638 [inline]\n __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\nRIP: 0033:0x7f1b2dea3759\nCode: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffd4de452f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f1b2def0390 RCX: 00007f1b2dea3759\nRDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000004\nRBP: 0000000000000003 R08: 0000555500000000 R09: 0000555500000000\nR10: 0000555500000000 R11: 0000000000000246 R12: 00007ffd4de45340\nR13: 00007ffd4de45310 R14: 0000000000000001 R15: 00007ffd4de45340', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
debian: CVE-2024-26815 was patched at 2024-04-13, 2024-05-15
ubuntu: CVE-2024-26815 was patched at 2024-06-07, 2024-06-11, 2024-06-14
335. Unknown Vulnerability Type - Linux Kernel (CVE-2024-26816) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nx86, relocs: Ignore relocations in .notes section\n\nWhen building with CONFIG_XEN_PV=y, .text symbols are emitted into\nthe .notes section so that Xen can find the "startup_xen" entry point.\nThis information is used prior to booting the kernel, so relocations\nare not useful. In fact, performing relocations against the .notes\nsection means that the KASLR base is exposed since /sys/kernel/notes\nis world-readable.\n\nTo avoid leaking the KASLR base without breaking unprivileged tools that\nare expecting to read /sys/kernel/notes, skip performing relocations in\nthe .notes section. The values readable in .notes are then identical to\nthose found in System.map.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11956 |
debian: CVE-2024-26816 was patched at 2024-04-13, 2024-05-06, 2024-05-15
ubuntu: CVE-2024-26816 was patched at 2024-06-07, 2024-06-10, 2024-06-11, 2024-06-14
336. Unknown Vulnerability Type - Linux Kernel (CVE-2024-27437) - Low [161]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Disable auto-enable of exclusive INTx IRQ\n\nCurrently for devices requiring masking at the irqchip for INTx, ie.\ndevices without DisINTx support, the IRQ is enabled in request_irq()\nand subsequently disabled as necessary to align with the masked status\nflag. This presents a window where the interrupt could fire between\nthese events, resulting in the IRQ incrementing the disable depth twice.\nThis would be unrecoverable for a user since the masked flag prevents\nnested enables through vfio.\n\nInstead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx\nis never auto-enabled, then unmask as required.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11956 |
debian: CVE-2024-27437 was patched at 2024-04-13, 2024-05-06, 2024-05-15
ubuntu: CVE-2024-27437 was patched at 2024-06-07, 2024-06-11, 2024-06-14
337. Unknown Vulnerability Type - Safari (CVE-2024-23263) - Low [157]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A logic issue was addressed with improved validation. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.8 | 14 | Safari is a web browser developed by Apple. It is built into Apple's operating systems, including macOS, iOS, iPadOS and their upcoming VisionOS, and uses Apple's open-source browser engine WebKit, which was derived from KHTML. | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15572 |
debian: CVE-2024-23263 was patched at 2024-05-09, 2024-05-15
ubuntu: CVE-2024-23263 was patched at 2024-04-15
338. Unknown Vulnerability Type - Safari (CVE-2024-23284) - Low [157]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A logic issue was addressed with improved state management. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.8 | 14 | Safari is a web browser developed by Apple. It is built into Apple's operating systems, including macOS, iOS, iPadOS and their upcoming VisionOS, and uses Apple's open-source browser engine WebKit, which was derived from KHTML. | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.15572 |
debian: CVE-2024-23284 was patched at 2024-05-09, 2024-05-15
ubuntu: CVE-2024-23284 was patched at 2024-04-15
339. Unknown Vulnerability Type - TLS (CVE-2024-28834) - Low [154]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.5 | 14 | TLS | |
0.5 | 10 | CVSS Base Score is 5.3. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.09411 |
almalinux: CVE-2024-28834 was patched at 2024-04-11, 2024-04-18, 2024-04-30
debian: CVE-2024-28834 was patched at 2024-05-15
oraclelinux: CVE-2024-28834 was patched at 2024-04-15, 2024-04-18, 2024-04-19, 2024-05-07, 2024-05-08
redhat: CVE-2024-28834 was patched at 2024-04-11, 2024-04-18, 2024-04-23, 2024-04-25, 2024-04-30, 2024-05-16
ubuntu: CVE-2024-28834 was patched at 2024-04-15, 2024-04-29
340. Unknown Vulnerability Type - Unknown Product (CVE-2023-32725) - Low [154]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 8.8. According to Vulners data source | |
0.4 | 10 | EPSS Probability is 0.00091, EPSS Percentile is 0.3819 |
debian: CVE-2023-32725 was patched at 2024-05-15
redos: CVE-2023-32725 was patched at 2024-03-28
341. Unknown Vulnerability Type - Mozilla Firefox (CVE-2024-3852) - Low [145]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10295 |
almalinux: CVE-2024-3852 was patched at 2024-04-18, 2024-04-22
debian: CVE-2024-3852 was patched at 2024-04-17, 2024-04-22, 2024-05-15
oraclelinux: CVE-2024-3852 was patched at 2024-04-18, 2024-04-19
redhat: CVE-2024-3852 was patched at 2024-04-18, 2024-04-22, 2024-04-23
ubuntu: CVE-2024-3852 was patched at 2024-04-24, 2024-04-25
342. Unknown Vulnerability Type - Safari (CVE-2024-23254) - Low [145]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'The issue was addressed with improved UI handling. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, Safari 17.4. A malicious website may exfiltrate audio data cross-origin.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.8 | 14 | Safari is a web browser developed by Apple. It is built into Apple's operating systems, including macOS, iOS, iPadOS and their upcoming VisionOS, and uses Apple's open-source browser engine WebKit, which was derived from KHTML. | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.11956 |
debian: CVE-2024-23254 was patched at 2024-05-09, 2024-05-15
ubuntu: CVE-2024-23254 was patched at 2024-04-15
343. Denial of Service - Unknown Product (CVE-2024-24786) - Low [136]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14012 |
almalinux: CVE-2024-24786 was patched at 2024-04-30, 2024-05-22
debian: CVE-2024-24786 was patched at 2024-05-15
oraclelinux: CVE-2024-24786 was patched at 2024-04-16, 2024-04-26, 2024-05-07, 2024-05-29
redhat: CVE-2024-24786 was patched at 2024-03-27, 2024-04-02, 2024-04-03, 2024-04-18, 2024-04-30, 2024-05-22, 2024-06-12
redos: CVE-2024-24786 was patched at 2024-05-22
ubuntu: CVE-2024-24786 was patched at 2024-04-23
344. Unknown Vulnerability Type - Curl (CVE-2024-2004) - Low [128]
Description: {'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.', 'bdu_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The exploit's existence is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.7 | 14 | Curl is a command-line tool for transferring data specified with URL syntax | |
0.0< |