Report Name: Linux Patch Wednesday July 2024Generated: 2024-07-18 13:49:21
Product Name | Prevalence | U | C | H | M | L | A | Comment |
---|---|---|---|---|---|---|---|---|
Apache HTTP Server | 0.9 | 3 | 2 | 3 | 8 | Apache HTTP Server is a free and open-source web server that delivers web content through the internet | ||
HTTP/2 | 0.9 | 1 | 1 | HTTP/2 is a major revision of the HTTP network protocol used by the World Wide Web | ||||
Linux Kernel | 0.9 | 3 | 148 | 347 | 498 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | ||
Chromium | 0.8 | 11 | 1 | 12 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |||
MIT Kerberos 5 | 0.8 | 2 | 2 | Kerberos is a computer-network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner | ||||
Mozilla Firefox | 0.8 | 12 | 9 | 21 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |||
Node.js | 0.8 | 1 | 1 | 2 | 4 | Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more | ||
OpenSSH | 0.8 | 1 | 1 | 1 | 3 | OpenSSH is a suite of secure networking utilities based on the Secure Shell protocol, which provides a secure channel over an unsecured network in a client–server architecture | ||
OpenSSL | 0.8 | 1 | 1 | 2 | A software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end | |||
RADIUS Protocol | 0.8 | 1 | 1 | Remote Authentication Dial-In User Service is a networking protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service | ||||
Secure Boot | 0.8 | 1 | 1 | 2 | Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM) | |||
.NET Core and Visual Studio | 0.7 | 1 | 1 | .NET Core and Visual Studio | ||||
.NET and Visual Studio | 0.7 | 1 | 1 | 2 | .NET and Visual Studio | |||
Apache Tomcat | 0.7 | 1 | 1 | Apache Tomcat is a free and open-source implementation of the Jakarta Servlet, Jakarta Expression Language, and WebSocket technologies | ||||
Curl | 0.7 | 1 | 1 | Curl is a command-line tool for transferring data specified with URL syntax | ||||
FFmpeg | 0.7 | 1 | 1 | 2 | FFmpeg is a free and open-source software project consisting of a suite of libraries and programs for handling video, audio, and other multimedia files and streams | |||
QEMU | 0.7 | 1 | 2 | 3 | QEMU is a generic and open source machine & userspace emulator and virtualizer | |||
AdminerEvo | 0.6 | 2 | 2 | AdminerEvo is a web-based database management interface, with a focus on security, user experience, performance, functionality and size | ||||
Exim | 0.6 | 1 | 1 | Exim is a mail transfer agent (MTA) used on Unix-like operating systems | ||||
Nextcloud | 0.6 | 1 | 8 | 9 | Nextcloud server is a self hosted personal cloud system | |||
Oracle Java SE | 0.6 | 1 | 2 | 3 | 6 | Oracle Java SE | ||
PHP Secure Communications Library | 0.6 | 1 | 1 | phpseclib provides pure-PHP implementations of SSH2, SFTP, RSA, DSA, Elliptic Curves, AES, ChaCha20, X. 509, CSR, CRL, SPKAC | ||||
Perl | 0.6 | 1 | 2 | 3 | Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages | |||
Python | 0.6 | 2 | 4 | 1 | 7 | Python is a high-level, general-purpose programming language | ||
ReCAPTCHA | 0.6 | 1 | 1 | reCAPTCHA is a security service that protects your websites from fraud and abuse owned by Google | ||||
phpLDAPadmin | 0.6 | 1 | 1 | phpLDAPadmin is a web based LDAP data management tool for system administrators | ||||
389 Directory Server | 0.5 | 2 | 2 | 389 Directory Server is a highly usable, fully featured, reliable and secure LDAP server implementation | ||||
7-Zip | 0.5 | 1 | 1 | 2 | 7-Zip is a free and open-source file archiver, a utility used to place groups of files within compressed containers known as "archives" | |||
Certifi collection | 0.5 | 1 | 1 | Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts | ||||
Cinder | 0.5 | 1 | 1 | Product detected by a:openstack:cinder (exists in CPE dict) | ||||
Diffie-Hellman Key Exchange | 0.5 | 1 | 1 | Product detected by a:diffie-hellman_key_exchange_project:diffie-hellman_key_exchange (exists in CPE dict) | ||||
Eclipse IDE | 0.5 | 1 | 1 | Product detected by a:eclipse:eclipse_ide (exists in CPE dict) | ||||
Go Project | 0.5 | 1 | 1 | Go is an open source project developed by a team at Google and many contributors from the open source community | ||||
OpenTelemetry | 0.5 | 1 | 1 | OpenTelemetry is a collection of APIs, SDKs, and tools. Use it to instrument, generate, collect, and export telemetry data (metrics, logs and traces) to help you analyze your software's performance and behavior | ||||
Poppler | 0.5 | 1 | 1 | Product detected by a:freedesktop:poppler (exists in CPE dict) | ||||
Setuptools | 0.5 | 1 | 1 | Setuptools is a fully-featured, actively-maintained, and stable library designed to facilitate packaging Python projects | ||||
Suricata | 0.5 | 1 | 2 | 1 | 4 | Product detected by a:oisf:suricata (exists in CPE dict) | ||
Xrdp | 0.5 | 1 | 1 | xrdp is an open source remote desktop protocol server | ||||
ZNC | 0.5 | 1 | 1 | ZNC is an advanced IRC bouncer that is left connected so an IRC client can disconnect/reconnect without losing the chat session | ||||
arm-trusted-firmware | 0.5 | 1 | 1 | Product detected by o:rensas:arm-trusted-firmware (does NOT exist in CPE dict) | ||||
qt | 0.5 | 1 | 1 | Product detected by a:qt:qt (exists in CPE dict) | ||||
rcar_gen3 | 0.5 | 1 | 1 | Product detected by a:renesas:rcar_gen3 (does NOT exist in CPE dict) | ||||
retryablehttp | 0.5 | 1 | 1 | Product detected by a:hashicorp:retryablehttp (does NOT exist in CPE dict) | ||||
youtube-dl | 0.5 | 1 | 1 | youtube-dl is a free and open source software tool for downloading video and audio from YouTube and over 1,000 other video hosting websites | ||||
GPAC | 0.4 | 4 | 4 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | ||||
Git | 0.4 | 2 | 2 | Git | ||||
LLDP | 0.4 | 1 | 1 | LLDP is an industry standard protocol designed to supplant proprietary Link-Layer protocols such as Extreme's EDP (Extreme Discovery Protocol) and CDP (Cisco Discovery Protocol) | ||||
Artifex Ghostscript | 0.3 | 1 | 4 | 5 | Artifex Ghostscript is an interpreter for the PostScript® language and PDF files | |||
Unknown Product | 0 | 33 | 42 | 75 | Unknown Product |
Vulnerability Type | Criticality | U | C | H | M | L | A |
---|---|---|---|---|---|---|---|
Remote Code Execution | 1.0 | 1 | 7 | 10 | 1 | 19 | |
Authentication Bypass | 0.98 | 2 | 9 | 11 | |||
Code Injection | 0.97 | 2 | 2 | ||||
Command Injection | 0.97 | 2 | 4 | 6 | |||
XXE Injection | 0.97 | 1 | 1 | ||||
Security Feature Bypass | 0.9 | 4 | 10 | 3 | 17 | ||
Elevation of Privilege | 0.85 | 2 | 2 | ||||
Arbitrary File Reading | 0.83 | 1 | 1 | ||||
Information Disclosure | 0.83 | 1 | 4 | 3 | 8 | ||
Cross Site Scripting | 0.8 | 3 | 3 | 6 | |||
Denial of Service | 0.7 | 4 | 46 | 7 | 57 | ||
Path Traversal | 0.7 | 1 | 3 | 4 | |||
Incorrect Calculation | 0.5 | 6 | 1 | 7 | |||
Memory Corruption | 0.5 | 1 | 2 | 147 | 8 | 158 | |
Spoofing | 0.4 | 1 | 1 | ||||
Unknown Vulnerability Type | 0 | 10 | 395 | 405 |
Source | U | C | H | M | L | A |
---|---|---|---|---|---|---|
almalinux | 1 | 1 | 3 | 2 | 7 | |
debian | 2 | 14 | 210 | 365 | 591 | |
oraclelinux | 1 | 2 | 6 | 1 | 10 | |
redhat | 1 | 4 | 9 | 6 | 20 | |
redos | 1 | 6 | 16 | 19 | 42 | |
ubuntu | 1 | 5 | 42 | 52 | 100 |
1. Memory Corruption - OpenSSH (CVE-2024-6387) - Critical [639]
Description: A security regression (CVE-2006-5051) was discovered in
almalinux: CVE-2024-6387 was patched at 2024-07-03
debian: CVE-2024-6387 was patched at 2024-07-01, 2024-07-16
oraclelinux: CVE-2024-6387 was patched at 2024-07-01, 2024-07-04
redhat: CVE-2024-6387 was patched at 2024-07-03, 2024-07-05, 2024-07-08
redos: CVE-2024-6387 was patched at 2024-07-04
ubuntu: CVE-2024-6387 was patched at 2024-07-01
2. Remote Code Execution - ZNC (CVE-2024-39844) - Critical [607]
Description: In
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners:PublicExploit:GitHub:PH1NS:CVE-2024-39844 website | |
1.0 | 15 | Remote Code Execution | |
0.5 | 14 | ZNC is an advanced IRC bouncer that is left connected so an IRC client can disconnect/reconnect without losing the chat session | |
1.0 | 10 | CVSS Base Score is 9.8. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-39844 was patched at 2024-07-03, 2024-07-16
3. Denial of Service - OpenTelemetry (CVE-2023-45142) - High [565]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.7 | 15 | Denial of Service | |
0.5 | 14 | OpenTelemetry is a collection of APIs, SDKs, and tools. Use it to instrument, generate, collect, and export telemetry data (metrics, logs and traces) to help you analyze your software's performance and behavior | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.5 | 10 | EPSS Probability is 0.00116, EPSS Percentile is 0.45862 |
redhat: CVE-2023-45142 was patched at 2024-06-26
4. Security Feature Bypass - Exim (CVE-2024-39929) - High [546]
Description: {'nvd_cve_data_all': 'Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.9 | 15 | Security Feature Bypass | |
0.6 | 14 | Exim is a mail transfer agent (MTA) used on Unix-like operating systems | |
0.5 | 10 | CVSS Base Score is 5.4. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-39929 was patched at 2024-07-10, 2024-07-16
redos: CVE-2024-39929 was patched at 2024-07-13
5. XXE Injection - Eclipse IDE (CVE-2023-4218) - High [542]
Description: In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on NVD:PublicExploit:gitlab.eclipse.org website | |
0.97 | 15 | XXE Injection | |
0.5 | 14 | Product detected by a:eclipse:eclipse_ide (exists in CPE dict) | |
0.5 | 10 | CVSS Base Score is 5.0. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.16519 |
redos: CVE-2023-4218 was patched at 2024-07-04
6. Authentication Bypass - RADIUS Protocol (CVE-2024-3596) - High [534]
Description: {'nvd_cve_data_all': 'RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.98 | 15 | Authentication Bypass | |
0.8 | 14 | Remote Authentication Dial-In User Service is a networking protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-3596 was patched at 2024-07-16
ubuntu: CVE-2024-35968 was patched at 2024-07-11, 2024-07-16
7. Denial of Service - Suricata (CVE-2024-38536) - High [529]
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A memory allocation failure due to `http.memcap` being reached leads to a NULL-ptr reference
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on NVD:PublicExploit:redmine.openinfosecfoundation.org website | |
0.7 | 15 | Denial of Service | |
0.5 | 14 | Product detected by a:oisf:suricata (exists in CPE dict) | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.21648 |
debian: CVE-2024-38536 was patched at 2024-07-16
8. Denial of Service - QEMU (CVE-2024-3567) - High [527]
Description: A flaw was found in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on NVD:PublicExploit:gitlab.com, BDU:PublicExploit websites | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | QEMU is a generic and open source machine & userspace emulator and virtualizer | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
redos: CVE-2024-3567 was patched at 2024-06-27
9. Security Feature Bypass - Nextcloud (CVE-2024-22403) - High [522]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.9 | 15 | Security Feature Bypass | |
0.6 | 14 | Nextcloud server is a self hosted personal cloud system | |
0.3 | 10 | CVSS Base Score is 3.0. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00051, EPSS Percentile is 0.20304 |
redos: CVE-2024-22403 was patched at 2024-06-27
10. Memory Corruption - 7-Zip (CVE-2023-52168) - High [494]
Description: The NtfsHandler.cpp NTFS handler in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on BDU:PublicExploit website | |
0.5 | 15 | Memory Corruption | |
0.5 | 14 | 7-Zip is a free and open-source file archiver, a utility used to place groups of files within compressed containers known as "archives" | |
0.8 | 10 | CVSS Base Score is 8.4. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2023-52168 was patched at 2024-07-16
redos: CVE-2023-52168 was patched at 2024-07-13
11. Security Feature Bypass - Python (CVE-2020-15801) - High [463]
Description: In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected.
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.6 | 14 | Python is a high-level, general-purpose programming language | |
1.0 | 10 | CVSS Base Score is 9.8. According to NVD data source | |
0.7 | 10 | EPSS Probability is 0.00295, EPSS Percentile is 0.69589 |
redos: CVE-2020-15801 was patched at 2024-07-04
12. Memory Corruption - Linux Kernel (CVE-2022-48711) - High [453]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners:PublicExploit:GitHub:WLSWOTMD:CVE-2022-0435 website | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2022-48711 was patched at 2024-06-30
13. Remote Code Execution - Apache HTTP Server (CVE-2024-38475) - High [447]
Description: Improper escaping of output in mod_rewrite in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.9 | 14 | Apache HTTP Server is a free and open-source web server that delivers web content through the internet | |
0.9 | 10 | CVSS Base Score is 9.1. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-38475 was patched at 2024-07-11, 2024-07-16
ubuntu: CVE-2024-38475 was patched at 2024-07-08
14. Remote Code Execution - Linux Kernel (CVE-2024-38605) - High [447]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.9 | 10 | CVSS Base Score is 8.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-38605 was patched at 2024-06-30, 2024-07-15
15. Remote Code Execution - .NET and Visual Studio (CVE-2024-35264) - High [438]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.7 | 14 | .NET and Visual Studio | |
0.8 | 10 | CVSS Base Score is 8.1. According to NVD data source | |
0.4 | 10 | EPSS Probability is 0.00091, EPSS Percentile is 0.39444 |
almalinux: CVE-2024-35264 was patched at 2024-07-10
oraclelinux: CVE-2024-35264 was patched at 2024-07-10
redhat: CVE-2024-35264 was patched at 2024-07-10
ubuntu: CVE-2024-35264 was patched at 2024-07-10
16. Command Injection - Apache HTTP Server (CVE-2024-38472) - High [430]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0.9 | 14 | Apache HTTP Server is a free and open-source web server that delivers web content through the internet | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-38472 was patched at 2024-07-16
17. Command Injection - Apache HTTP Server (CVE-2024-39573) - High [430]
Description: Potential
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0.9 | 14 | Apache HTTP Server is a free and open-source web server that delivers web content through the internet | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-39573 was patched at 2024-07-11, 2024-07-16
ubuntu: CVE-2024-39573 was patched at 2024-07-08
18. Remote Code Execution - OpenSSH (CVE-2024-6409) - High [419]
Description: A race condition vulnerability was discovered in how signals are handled by
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.8 | 14 | OpenSSH is a suite of secure networking utilities based on the Secure Shell protocol, which provides a secure channel over an unsecured network in a client–server architecture | |
0.7 | 10 | CVSS Base Score is 7.0. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.17474 |
oraclelinux: CVE-2024-6409 was patched at 2024-07-10
redhat: CVE-2024-6409 was patched at 2024-07-10
19. Remote Code Execution - Secure Boot (CVE-2024-6287) - High [419]
Description: Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. When checking whether a new image invades/overlaps with a previously loaded image the code neglects to consider a few cases. that could An attacker to bypass memory range restriction and overwrite an already loaded image partly or completely, which could result in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.8 | 14 | Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM) | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6287 was patched at 2024-06-30
20. Denial of Service - Linux Kernel (CVE-2022-48716) - High [417]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
1.0 | 10 | CVSS Base Score is 9.8. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48716 was patched at 2024-06-30
21. Remote Code Execution - Python (CVE-2024-39705) - High [409]
Description: NLTK through 3.8.1 allows remote
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.6 | 14 | Python is a high-level, general-purpose programming language | |
1.0 | 10 | CVSS Base Score is 9.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-39705 was patched at 2024-06-30
22. Security Feature Bypass - Curl (CVE-2024-5261) - High [408]
Description: Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents. LibreOffice internally makes use of "
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.7 | 14 | Curl is a command-line tool for transferring data specified with URL syntax | |
1.0 | 10 | CVSS Base Score is 10.0. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
ubuntu: CVE-2024-5261 was patched at 2024-07-04
23. Remote Code Execution - Node.js (CVE-2024-22020) - High [407]
Description: A security flaw in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.8 | 14 | Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more | |
0.7 | 10 | CVSS Base Score is 6.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-22020 was patched at 2024-07-16
24. Authentication Bypass - Oracle Java SE (CVE-2024-21147) - High [405]
Description: Vulnerability in the Oracle
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.6 | 14 | Oracle Java SE | |
0.7 | 10 | CVSS Base Score is 7.4. According to NVD data source | |
0.4 | 10 | EPSS Probability is 0.00091, EPSS Percentile is 0.39444 |
redhat: CVE-2024-21147 was patched at 2024-07-17
25. Information Disclosure - OpenSSL (CVE-2024-5535) - High [400]
Description: Issue summary: Calling the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.83 | 15 | Information Disclosure | |
0.8 | 14 | A software library for applications that secure communications over computer networks against eavesdropping or need to identify the party at the other end | |
0.9 | 10 | CVSS Base Score is 9.1. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-5535 was patched at 2024-06-30
26. Denial of Service - Diffie-Hellman Key Exchange (CVE-2022-40735) - Medium [398]
Description: The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that "(appropriately) short exponents" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together.
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.5 | 14 | Product detected by a:diffie-hellman_key_exchange_project:diffie-hellman_key_exchange (exists in CPE dict) | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.8 | 10 | EPSS Probability is 0.01009, EPSS Percentile is 0.83859 |
ubuntu: CVE-2022-40735 was patched at 2024-06-27
27. Authentication Bypass - Nextcloud (CVE-2024-37882) - Medium [394]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.6 | 14 | Nextcloud server is a self hosted personal cloud system | |
0.8 | 10 | CVSS Base Score is 8.1. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
redos: CVE-2024-37882 was patched at 2024-06-27
28. Denial of Service - Linux Kernel (CVE-2021-4440) - Medium [394]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.9 | 10 | CVSS Base Score is 8.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2021-4440 was patched at 2024-06-30
29. Denial of Service - Linux Kernel (CVE-2022-48748) - Medium [394]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48748 was patched at 2024-06-30
30. Denial of Service - Linux Kernel (CVE-2024-38616) - Medium [394]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 8.2. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38616 was patched at 2024-06-30
31. Authentication Bypass - Nextcloud (CVE-2024-37313) - Medium [382]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.6 | 14 | Nextcloud server is a self hosted personal cloud system | |
0.7 | 10 | CVSS Base Score is 7.3. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
redos: CVE-2024-37313 was patched at 2024-06-27
32. Denial of Service - Linux Kernel (CVE-2024-39479) - Medium [382]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 7.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-39479 was patched at 2024-07-16
33. Memory Corruption - Linux Kernel (CVE-2024-38541) - Medium [382]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
1.0 | 10 | CVSS Base Score is 9.8. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38541 was patched at 2024-06-30
34. Remote Code Execution - Setuptools (CVE-2024-6345) - Medium [380]
Description: A vulnerability in the package_index module of pypa/
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.5 | 14 | Setuptools is a fully-featured, actively-maintained, and stable library designed to facilitate packaging Python projects | |
0.9 | 10 | CVSS Base Score is 8.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6345 was patched at 2024-07-16
35. Denial of Service - .NET and Visual Studio (CVE-2024-38095) - Medium [372]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | .NET and Visual Studio | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.3 | 10 | EPSS Probability is 0.00063, EPSS Percentile is 0.27545 |
almalinux: CVE-2024-38095 was patched at 2024-07-09, 2024-07-10
oraclelinux: CVE-2024-38095 was patched at 2024-07-09, 2024-07-10
redhat: CVE-2024-38095 was patched at 2024-07-09, 2024-07-10
ubuntu: CVE-2024-38095 was patched at 2024-07-10
36. Authentication Bypass - Nextcloud (CVE-2023-49792) - Medium [370]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.6 | 14 | Nextcloud server is a self hosted personal cloud system | |
0.5 | 10 | CVSS Base Score is 5.3. According to NVD data source | |
0.3 | 10 | EPSS Probability is 0.00068, EPSS Percentile is 0.303 |
redos: CVE-2023-49792 was patched at 2024-06-27
37. Memory Corruption - Linux Kernel (CVE-2024-38612) - Medium [370]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
1.0 | 10 | CVSS Base Score is 9.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-38612 was patched at 2024-06-30, 2024-07-15
38. Command Injection - AdminerEvo (CVE-2023-45195) - Medium [368]
Description: Adminer and
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0.6 | 14 | AdminerEvo is a web-based database management interface, with a focus on security, user experience, performance, functionality and size | |
0.7 | 10 | CVSS Base Score is 6.9. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2023-45195 was patched at 2024-06-30
39. Command Injection - phpLDAPadmin (CVE-2016-15039) - Medium [368]
Description: A vulnerability classified as critical was found in mhuertos
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0.6 | 14 | phpLDAPadmin is a web based LDAP data management tool for system administrators | |
0.6 | 10 | CVSS Base Score is 6.3. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2016-15039 was patched at 2024-07-16
40. Denial of Service - Node.js (CVE-2024-37890) - Medium [365]
Description: ws is an open source WebSocket client and server for
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.8 | 14 | Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-37890 was patched at 2024-06-30
41. Memory Corruption - Mozilla Firefox (CVE-2024-6602) - Medium [365]
Description: A mismatch between allocator and deallocator could have lead to
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
1.0 | 10 | CVSS Base Score is 9.8. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-6602 was patched at 2024-07-10, 2024-07-16
ubuntu: CVE-2024-6602 was patched at 2024-07-10
42. Memory Corruption - Mozilla Firefox (CVE-2024-6606) - Medium [365]
Description: Clipboard code failed to check the index on an array access. This could have lead to an
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
1.0 | 10 | CVSS Base Score is 9.8. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-6606 was patched at 2024-07-10
43. Information Disclosure - Mozilla Firefox (CVE-2024-6612) - Medium [364]
Description: CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CSP violation happened. This vulnerability affects
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.83 | 15 | Information Disclosure | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.5 | 10 | CVSS Base Score is 5.3. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-6612 was patched at 2024-07-10
44. Security Feature Bypass - Certifi collection (CVE-2024-39689) - Medium [363]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.5 | 14 | Certifi is a carefully curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16049 |
debian: CVE-2024-39689 was patched at 2024-07-16
45. Denial of Service - .NET Core and Visual Studio (CVE-2024-30105) - Medium [360]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | .NET Core and Visual Studio | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.17374 |
almalinux: CVE-2024-30105 was patched at 2024-07-10
oraclelinux: CVE-2024-30105 was patched at 2024-07-10
redhat: CVE-2024-30105 was patched at 2024-07-10
ubuntu: CVE-2024-30105 was patched at 2024-07-10
46. Authentication Bypass - Nextcloud (CVE-2023-49791) - Medium [358]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.6 | 14 | Nextcloud server is a self hosted personal cloud system | |
0.5 | 10 | CVSS Base Score is 5.4. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.21897 |
redos: CVE-2023-49791 was patched at 2024-06-27
47. Authentication Bypass - Nextcloud (CVE-2024-37317) - Medium [358]
Description: The
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.6 | 14 | Nextcloud server is a self hosted personal cloud system | |
0.5 | 10 | CVSS Base Score is 4.6. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
redos: CVE-2024-37317 was patched at 2024-06-28
48. Denial of Service - Linux Kernel (CVE-2024-36288) - Medium [358]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-36288 was patched at 2024-06-30, 2024-07-15
49. Denial of Service - Linux Kernel (CVE-2024-39472) - Medium [358]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-39472 was patched at 2024-07-16
50. Denial of Service - Linux Kernel (CVE-2024-39474) - Medium [358]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-39474 was patched at 2024-07-16
51. Denial of Service - Linux Kernel (CVE-2024-39478) - Medium [358]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-39478 was patched at 2024-07-16
52. Denial of Service - Linux Kernel (CVE-2024-39482) - Medium [358]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-39482 was patched at 2024-07-15, 2024-07-16
53. Denial of Service - Linux Kernel (CVE-2024-39484) - Medium [358]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-39484 was patched at 2024-07-15, 2024-07-16
54. Authentication Bypass - Xrdp (CVE-2024-39917) - Medium [353]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.5 | 14 | xrdp is an open source remote desktop protocol server | |
0.7 | 10 | CVSS Base Score is 7.2. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-39917 was patched at 2024-07-16
55. Remote Code Execution - Git (CVE-2024-6257) - Medium [352]
Description: HashiCorp’s go-getter library can be coerced into executing
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.4 | 14 | Git | |
0.8 | 10 | CVSS Base Score is 8.4. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6257 was patched at 2024-06-30
56. Remote Code Execution - Linux Kernel (CVE-2024-26818) - Medium [352]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-26818 was patched at 2024-07-12, 2024-07-16, 2024-07-17
57. Denial of Service - Suricata (CVE-2024-38535) - Medium [351]
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Suricata can run out of memory when parsing crafted HTTP/2 traffic. Upgrade to 6.0.20 or 7.0.6.
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.5 | 14 | Product detected by a:oisf:suricata (exists in CPE dict) | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.4 | 10 | EPSS Probability is 0.00088, EPSS Percentile is 0.38169 |
debian: CVE-2024-38535 was patched at 2024-07-16
58. Security Feature Bypass - Poppler (CVE-2024-6239) - Medium [351]
Description: A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.5 | 14 | Product detected by a:freedesktop:poppler (exists in CPE dict) | |
0.7 | 10 | CVSS Base Score is 6.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.17374 |
debian: CVE-2024-6239 was patched at 2024-06-30
59. Denial of Service - Apache Tomcat (CVE-2024-34750) - Medium [348]
Description: Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | Apache Tomcat is a free and open-source implementation of the Jakarta Servlet, Jakarta Expression Language, and WebSocket technologies | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-34750 was patched at 2024-07-16
60. Denial of Service - QEMU (CVE-2024-4467) - Medium [348]
Description: A flaw was found in the QEMU disk image utility (
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | QEMU is a generic and open source machine & userspace emulator and virtualizer | |
0.8 | 10 | CVSS Base Score is 7.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
almalinux: CVE-2024-4467 was patched at 2024-07-02, 2024-07-09
debian: CVE-2024-4467 was patched at 2024-07-16
oraclelinux: CVE-2024-4467 was patched at 2024-07-02, 2024-07-12
redhat: CVE-2024-4467 was patched at 2024-07-02, 2024-07-08, 2024-07-09
61. Memory Corruption - Linux Kernel (CVE-2022-48754) - Medium [346]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 8.4. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2022-48754 was patched at 2024-06-30
62. Memory Corruption - Linux Kernel (CVE-2024-38573) - Medium [346]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-38573 was patched at 2024-06-30
63. Memory Corruption - Linux Kernel (CVE-2024-38667) - Medium [346]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 7.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-38667 was patched at 2024-06-30
64. Memory Corruption - Linux Kernel (CVE-2024-39277) - Medium [346]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 7.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-39277 was patched at 2024-06-30
65. Memory Corruption - Linux Kernel (CVE-2024-39480) - Medium [346]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 7.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-39480 was patched at 2024-07-15, 2024-07-16
66. Memory Corruption - Chromium (CVE-2024-6290) - Medium [341]
Description: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-6290 was patched at 2024-06-25, 2024-06-30
67. Memory Corruption - Chromium (CVE-2024-6291) - Medium [341]
Description: Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-6291 was patched at 2024-06-25, 2024-06-30
68. Memory Corruption - Chromium (CVE-2024-6292) - Medium [341]
Description: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-6292 was patched at 2024-06-25, 2024-06-30
69. Memory Corruption - Chromium (CVE-2024-6293) - Medium [341]
Description: Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-6293 was patched at 2024-06-25, 2024-06-30
70. Remote Code Execution - Linux Kernel (CVE-2022-48744) - Medium [340]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2022-48744 was patched at 2024-06-30
71. Command Injection - Apache HTTP Server (CVE-2024-38476) - Medium [335]
Description: Vulnerability in core of
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0.9 | 14 | Apache HTTP Server is a free and open-source web server that delivers web content through the internet | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-38476 was patched at 2024-07-11, 2024-07-16
ubuntu: CVE-2024-38476 was patched at 2024-07-08
72. Authentication Bypass - Nextcloud (CVE-2024-37315) - Medium [334]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.6 | 14 | Nextcloud server is a self hosted personal cloud system | |
0.3 | 10 | CVSS Base Score is 3.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
redos: CVE-2024-37315 was patched at 2024-06-27
73. Authentication Bypass - Nextcloud (CVE-2024-37884) - Medium [334]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.6 | 14 | Nextcloud server is a self hosted personal cloud system | |
0.3 | 10 | CVSS Base Score is 3.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
redos: CVE-2024-37884 was patched at 2024-06-27
74. Authentication Bypass - Nextcloud (CVE-2024-37887) - Medium [334]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.98 | 15 | Authentication Bypass | |
0.6 | 14 | Nextcloud server is a self hosted personal cloud system | |
0.3 | 10 | CVSS Base Score is 3.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
redos: CVE-2024-37887 was patched at 2024-06-27
75. Denial of Service - Python (CVE-2023-6507) - Medium [332]
Description: An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not call `setgroups(0, NULL)` before calling `exec()`, thus not dropping the original processes' groups before starting the new process. There is no issue when the parameter isn't used or when any value is used besides an empty list. This issue only impacts CPython processes run with sufficient privilege to make the `setgroups` system call (typically `root`).
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.6 | 14 | Python is a high-level, general-purpose programming language | |
0.6 | 10 | CVSS Base Score is 6.1. According to NVD data source | |
0.3 | 10 | EPSS Probability is 0.0006, EPSS Percentile is 0.26121 |
ubuntu: CVE-2023-6507 was patched at 2024-07-11
76. Memory Corruption - Mozilla Firefox (CVE-2024-6603) - Medium [329]
Description: In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.7 | 10 | CVSS Base Score is 7.4. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-6603 was patched at 2024-07-10, 2024-07-16
oraclelinux: CVE-2024-6603 was patched at 2024-07-11
redhat: CVE-2024-6603 was patched at 2024-07-11, 2024-07-17
ubuntu: CVE-2024-6603 was patched at 2024-07-10
77. Denial of Service - Suricata (CVE-2024-38534) - Medium [327]
Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Crafted modbus traffic can lead to unlimited resource accumulation within a flow. Upgrade to 7.0.6. Set a limited stream.reassembly.depth to reduce the issue.
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.5 | 14 | Product detected by a:oisf:suricata (exists in CPE dict) | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00056, EPSS Percentile is 0.2358 |
debian: CVE-2024-38534 was patched at 2024-07-16
78. Denial of Service - QEMU (CVE-2024-6505) - Medium [324]
Description: A flaw was found in the virtio-net device in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.7 | 14 | QEMU is a generic and open source machine & userspace emulator and virtualizer | |
0.6 | 10 | CVSS Base Score is 6.0. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13748 |
debian: CVE-2024-6505 was patched at 2024-07-16
79. Incorrect Calculation - Linux Kernel (CVE-2024-39475) - Medium [322]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-39475 was patched at 2024-07-15, 2024-07-16
80. Memory Corruption - Linux Kernel (CVE-2024-26986) - Medium [322]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
ubuntu: CVE-2024-26986 was patched at 2024-07-11, 2024-07-16
81. Memory Corruption - Linux Kernel (CVE-2024-35972) - Medium [322]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
ubuntu: CVE-2024-35972 was patched at 2024-07-11, 2024-07-16
82. Memory Corruption - Linux Kernel (CVE-2024-39292) - Medium [322]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-39292 was patched at 2024-06-30, 2024-07-15
83. Security Feature Bypass - Git (CVE-2024-6284) - Medium [322]
Description: In https://
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.4 | 14 | Git | |
0.6 | 10 | CVSS Base Score is 6.3. According to Vulners data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-6284 was patched at 2024-07-16
84. Denial of Service - AdminerEvo (CVE-2023-45196) - Medium [320]
Description: Adminer and
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.6 | 14 | AdminerEvo is a web-based database management interface, with a focus on security, user experience, performance, functionality and size | |
0.7 | 10 | CVSS Base Score is 6.9. According to Vulners data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2023-45196 was patched at 2024-06-30
85. Arbitrary File Reading - Artifex Ghostscript (CVE-2024-29511) - Medium [317]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.83 | 15 | Arbitrary File Reading | |
0.3 | 14 | Artifex Ghostscript is an interpreter for the PostScript® language and PDF files | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-29511 was patched at 2024-07-16
ubuntu: CVE-2024-29511 was patched at 2024-07-15
86. Memory Corruption - Secure Boot (CVE-2024-6564) - Medium [317]
Description: Buffer overflow in "rcar_dev_init" due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM) | |
0.7 | 10 | CVSS Base Score is 6.7. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6564 was patched at 2024-07-16
87. Path Traversal - youtube-dl (CVE-2024-38519) - Medium [315]
Description: `
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Path Traversal | |
0.5 | 14 | youtube-dl is a free and open source software tool for downloading video and audio from YouTube and over 1,000 other video hosting websites | |
0.8 | 10 | CVSS Base Score is 7.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-38519 was patched at 2024-07-16
88. Remote Code Execution - Unknown Product (CVE-2024-38999) - Medium [309]
Description: {'nvd_cve_data_all': 'jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
1.0 | 10 | CVSS Base Score is 10.0. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-38999 was patched at 2024-07-16
89. Denial of Service - Python (CVE-2024-5569) - Medium [308]
Description: A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of C
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.6 | 14 | Python is a high-level, general-purpose programming language | |
0.6 | 10 | CVSS Base Score is 6.2. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-5569 was patched at 2024-07-16
90. Code Injection - Unknown Product (CVE-2024-39331) - Medium [304]
Description: {'nvd_cve_data_all': 'In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.97 | 15 | Code Injection | |
0 | 14 | Unknown Product | |
1.0 | 10 | CVSS Base Score is 9.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-39331 was patched at 2024-06-25, 2024-06-30
redos: CVE-2024-39331 was patched at 2024-07-16
91. Memory Corruption - FFmpeg (CVE-2024-32228) - Medium [301]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.7 | 14 | FFmpeg is a free and open-source software project consisting of a suite of libraries and programs for handling video, audio, and other multimedia files and streams | |
0.7 | 10 | CVSS Base Score is 6.6. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-32228 was patched at 2024-07-16
92. Denial of Service - Linux Kernel (CVE-2022-48721) - Medium [298]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48721 was patched at 2024-06-30
93. Denial of Service - Linux Kernel (CVE-2024-35980) - Medium [298]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-35980 was patched at 2024-07-11, 2024-07-16
94. Denial of Service - Linux Kernel (CVE-2024-41009) - Medium [298]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-41009 was patched at 2024-07-17
95. Remote Code Execution - Unknown Product (CVE-2024-38448) - Medium [297]
Description: {'nvd_cve_data_all': 'htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.9 | 10 | CVSS Base Score is 9.1. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-38448 was patched at 2024-06-30
96. Denial of Service - Oracle Java SE (CVE-2024-21138) - Medium [296]
Description: Vulnerability in the Oracle
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.6 | 14 | Oracle Java SE | |
0.4 | 10 | CVSS Base Score is 3.7. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.17374 |
redhat: CVE-2024-21138 was patched at 2024-07-17
97. Denial of Service - Oracle Java SE (CVE-2024-21144) - Medium [296]
Description: Vulnerability in the Oracle
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.6 | 14 | Oracle Java SE | |
0.4 | 10 | CVSS Base Score is 3.7. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.17374 |
redhat: CVE-2024-21144 was patched at 2024-07-17
98. Unknown Vulnerability Type - Linux Kernel (CVE-2024-38623) - Medium [292]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use variable length array instead of fixed size Should fix smatch warning: \tntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256)', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Use variable length array instead of fixed size\n\nShould fix smatch warning:\n\tntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256)', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
1.0 | 10 | CVSS Base Score is 9.8. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38623 was patched at 2024-06-30
99. Denial of Service - 389 Directory Server (CVE-2024-5953) - Medium [291]
Description: A
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.5 | 14 | 389 Directory Server is a highly usable, fully featured, reliable and secure LDAP server implementation | |
0.6 | 10 | CVSS Base Score is 5.7. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-5953 was patched at 2024-06-30
100. Denial of Service - 389 Directory Server (CVE-2024-6237) - Medium [291]
Description: A flaw was found in the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.5 | 14 | 389 Directory Server is a highly usable, fully featured, reliable and secure LDAP server implementation | |
0.5 | 10 | CVSS Base Score is 5.3. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00053, EPSS Percentile is 0.21874 |
debian: CVE-2024-6237 was patched at 2024-07-16
101. Remote Code Execution - Perl (CVE-2024-27629) - Medium [290]
Description: An issue in dc2niix before v.1.0.20240202 allows a local attacker to
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0.6 | 14 | Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-27629 was patched at 2024-06-30
102. Denial of Service - Apache HTTP Server (CVE-2024-38477) - Medium [286]
Description: null pointer dereference in mod_proxy in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | Apache HTTP Server is a free and open-source web server that delivers web content through the internet | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-38477 was patched at 2024-07-11, 2024-07-16
ubuntu: CVE-2024-38477 was patched at 2024-07-08
103. Denial of Service - HTTP/2 (CVE-2024-36387) - Medium [286]
Description: Serving WebSocket protocol upgrades over a
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | HTTP/2 is a major revision of the HTTP network protocol used by the World Wide Web | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-36387 was patched at 2024-07-11, 2024-07-16
ubuntu: CVE-2024-36387 was patched at 2024-07-08
104. Denial of Service - Linux Kernel (CVE-2022-48795) - Medium [286]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2022-48795 was patched at 2024-07-16
105. Denial of Service - Linux Kernel (CVE-2024-27006) - Medium [286]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
ubuntu: CVE-2024-27006 was patched at 2024-07-11, 2024-07-16
106. Remote Code Execution - Unknown Product (CVE-2024-27628) - Medium [285]
Description: {'nvd_cve_data_all': 'Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 8.1. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-27628 was patched at 2024-06-30
107. Remote Code Execution - Unknown Product (CVE-2024-36600) - Medium [285]
Description: {'nvd_cve_data_all': 'Buffer Overflow Vulnerability in libcdio v2.1.0 allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Buffer Overflow Vulnerability in libcdio v2.1.0 allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 8.4. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
redos: CVE-2024-36600 was patched at 2024-06-26
ubuntu: CVE-2024-36600 was patched at 2024-06-28
108. Remote Code Execution - Unknown Product (CVE-2024-38998) - Medium [285]
Description: {'nvd_cve_data_all': 'jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 8.4. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-38998 was patched at 2024-07-16
109. Memory Corruption - Python (CVE-2024-0397) - Medium [284]
Description: A defect was discovered in the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.6 | 14 | Python is a high-level, general-purpose programming language | |
0.7 | 10 | CVSS Base Score is 7.4. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-0397 was patched at 2024-06-30
110. Code Injection - Unknown Product (CVE-2024-6655) - Medium [280]
Description: {'nvd_cve_data_all': 'A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.97 | 15 | Code Injection | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 7.0. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-6655 was patched at 2024-07-16
ubuntu: CVE-2024-6655 was patched at 2024-07-16
111. Incorrect Calculation - rcar_gen3 (CVE-2024-6285) - Medium [279]
Description: Integer Underflow (Wrap or Wraparound) vulnerability in Renesas arm-trusted-firmware. An integer underflow in image range check calculations could lead to bypassing address restrictions and loading of images to unallowed addresses.
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0.5 | 14 | Product detected by a:renesas:rcar_gen3 (does NOT exist in CPE dict) | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6285 was patched at 2024-06-30
112. Memory Corruption - arm-trusted-firmware (CVE-2024-6563) - Medium [279]
Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code. This vulnerability is associated with program files https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/i... https://github.Com/renesas-rcar/arm-trusted-firmware/blob/rcar_gen3_v2.5/drivers/renesas/common/io/io_rcar.C . In line 313 "addr_loaded_cnt" is checked not to be "CHECK_IMAGE_AREA_CNT" (5) or larger, this check does not halt the function. Immediately after (line 317) there will be an overflow in the buffer and the value of "dst" will be written to the area immediately after the buffer, which is "addr_loaded_cnt". This will allow an attacker to freely control the value of "addr_loaded_cnt" and thus control the destination of the write immediately after (line 318). The write in line 318 will then be fully controlled by said attacker, with whichever address and whichever value ("len") they desire.
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.5 | 14 | Product detected by o:rensas:arm-trusted-firmware (does NOT exist in CPE dict) | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6563 was patched at 2024-07-16
113. Unknown Vulnerability Type - Mozilla Firefox (CVE-2024-6611) - Medium [276]
Description: {'nvd_cve_data_all': 'A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
1.0 | 10 | CVSS Base Score is 9.8. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-6611 was patched at 2024-07-10
114. Security Feature Bypass - Python (CVE-2024-4032) - Medium [272]
Description: {'nvd_cve_data_all': 'The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.\n\nCPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.6 | 14 | Python is a high-level, general-purpose programming language | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.14567 |
debian: CVE-2024-4032 was patched at 2024-06-30
115. Security Feature Bypass - ReCAPTCHA (CVE-2024-34009) - Medium [272]
Description: Insufficient checks whether
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0.6 | 14 | reCAPTCHA is a security service that protects your websites from fraud and abuse owned by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
redos: CVE-2024-34009 was patched at 2024-07-01
116. Elevation of Privilege - Unknown Product (CVE-2024-38517) - Medium [270]
Description: {'nvd_cve_data_all': 'Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.85 | 15 | Elevation of Privilege | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38517 was patched at 2024-07-16
117. Unknown Vulnerability Type - Linux Kernel (CVE-2022-48747) - Medium [269]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: block: Fix wrong offset in bio_truncate() bio_truncate() clears the buffer outside of last block of bdev, however current bio_truncate() is using the wrong offset of page. So it can return the uninitialized data. This happened when both of truncated/corrupted FS and userspace (via bdev) are trying to read the last of bdev.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nblock: Fix wrong offset in bio_truncate()\n\nbio_truncate() clears the buffer outside of last block of bdev, however\ncurrent bio_truncate() is using the wrong offset of page. So it can\nreturn the uninitialized data.\n\nThis happened when both of truncated/corrupted FS and userspace (via\nbdev) are trying to read the last of bdev.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48747 was patched at 2024-06-30
118. Command Injection - Unknown Product (CVE-2024-34580) - Medium [268]
Description: {'nvd_cve_data_all': 'Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection against an SSRF payload in a KeyInfo element. NOTE: the supplier disputes this CVE Record on the grounds that they are implementing the specification "correctly" and are not "at fault."', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection against an SSRF payload in a KeyInfo element. NOTE: the supplier disputes this CVE Record on the grounds that they are implementing the specification "correctly" and are not "at fault."', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.97 | 15 | Command Injection | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.3. According to NVD data source | |
0.3 | 10 | EPSS Probability is 0.00062, EPSS Percentile is 0.26854 |
debian: CVE-2024-34580 was patched at 2024-06-30
119. Security Feature Bypass - Unknown Product (CVE-2024-34001) - Medium [267]
Description: {'nvd_cve_data_all': 'Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 8.4. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
redos: CVE-2024-34001 was patched at 2024-07-01
120. Security Feature Bypass - Unknown Product (CVE-2024-37794) - Medium [267]
Description: {'nvd_cve_data_all': 'Improper input validation in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT2 input file.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Improper input validation in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT2 input file.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-37794 was patched at 2024-06-30
121. Incorrect Calculation - Linux Kernel (CVE-2024-40994) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-40994 was patched at 2024-07-16
122. Incorrect Calculation - Linux Kernel (CVE-2024-40996) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-40996 was patched at 2024-07-16
123. Memory Corruption - Linux Kernel (CVE-2021-47585) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2021-47585 was patched at 2024-06-30
124. Memory Corruption - Linux Kernel (CVE-2021-47596) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2021-47596 was patched at 2024-06-30
redhat: CVE-2021-47596 was patched at 2024-07-15
125. Memory Corruption - Linux Kernel (CVE-2022-48712) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48712 was patched at 2024-06-30
126. Memory Corruption - Linux Kernel (CVE-2022-48726) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48726 was patched at 2024-06-30
127. Memory Corruption - Linux Kernel (CVE-2022-48733) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48733 was patched at 2024-06-30
128. Memory Corruption - Linux Kernel (CVE-2022-48745) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48745 was patched at 2024-06-30
129. Memory Corruption - Linux Kernel (CVE-2022-48763) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48763 was patched at 2024-06-30
130. Memory Corruption - Linux Kernel (CVE-2022-48768) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48768 was patched at 2024-06-30
131. Memory Corruption - Linux Kernel (CVE-2022-48789) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48789 was patched at 2024-07-16
132. Memory Corruption - Linux Kernel (CVE-2022-48791) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48791 was patched at 2024-07-16
133. Memory Corruption - Linux Kernel (CVE-2022-48792) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48792 was patched at 2024-07-16
134. Memory Corruption - Linux Kernel (CVE-2022-48796) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48796 was patched at 2024-07-16
135. Memory Corruption - Linux Kernel (CVE-2022-48801) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48801 was patched at 2024-07-16
136. Memory Corruption - Linux Kernel (CVE-2022-48821) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48821 was patched at 2024-07-16
137. Memory Corruption - Linux Kernel (CVE-2022-48842) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48842 was patched at 2024-07-16
138. Memory Corruption - Linux Kernel (CVE-2022-48846) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48846 was patched at 2024-07-16
139. Memory Corruption - Linux Kernel (CVE-2022-48847) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48847 was patched at 2024-07-16
140. Memory Corruption - Linux Kernel (CVE-2022-48858) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48858 was patched at 2024-07-16
141. Memory Corruption - Linux Kernel (CVE-2022-48861) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48861 was patched at 2024-07-16
142. Memory Corruption - Linux Kernel (CVE-2022-48863) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2022-48863 was patched at 2024-07-16
143. Memory Corruption - Linux Kernel (CVE-2024-26716) - Medium [263]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: usb: core: Prevent null pointer dereference in update_port_device_state Currently, the function update_port_device_state gets the usb_hub from udev->parent by calling usb_hub_to_struct_hub. However, in case the actconfig or the maxchild is 0, the usb_hub would be NULL and upon further accessing to get port_dev would result in null pointer dereference. Fix this by introducing an if check after the usb_hub is populated.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: Prevent null pointer dereference in update_port_device_state\n\nCurrently, the function update_port_device_state gets the usb_hub from\nudev->parent by calling usb_hub_to_struct_hub.\nHowever, in case the actconfig or the maxchild is 0, the usb_hub would\nbe NULL and upon further accessing to get port_dev would result in null\npointer dereference.\n\nFix this by introducing an if check after the usb_hub is populated.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-26716 was patched at 2024-07-12, 2024-07-16, 2024-07-17
144. Memory Corruption - Linux Kernel (CVE-2024-26734) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-26734 was patched at 2024-07-12, 2024-07-16, 2024-07-17
145. Memory Corruption - Linux Kernel (CVE-2024-26831) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-26831 was patched at 2024-07-12, 2024-07-16, 2024-07-17
146. Memory Corruption - Linux Kernel (CVE-2024-35882) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-35882 was patched at 2024-07-11, 2024-07-16
147. Memory Corruption - Linux Kernel (CVE-2024-35883) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-35883 was patched at 2024-07-11, 2024-07-16
148. Memory Corruption - Linux Kernel (CVE-2024-35911) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-35911 was patched at 2024-07-11, 2024-07-16
149. Memory Corruption - Linux Kernel (CVE-2024-35977) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-35977 was patched at 2024-07-11, 2024-07-16
150. Memory Corruption - Linux Kernel (CVE-2024-35979) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-35979 was patched at 2024-07-11, 2024-07-16
151. Memory Corruption - Linux Kernel (CVE-2024-36018) - Medium [263]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: nouveau/uvmm: fix addr/range calcs for remap operations dEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8 was causing a remap operation like the below. op_remap: prev: 0000003fffed0000 00000000000f0000 00000000a5abd18a 0000000000000000 op_remap: next: op_remap: unmap: 0000003fffed0000 0000000000100000 0 op_map: map: 0000003ffffc0000 0000000000010000 000000005b1ba33c 00000000000e0000 This was resulting in an unmap operation from 0x3fffed0000+0xf0000, 0x100000 which was corrupting the pagetables and oopsing the kernel. Fixes the prev + unmap range calcs to use start/end and map back to addr/range.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau/uvmm: fix addr/range calcs for remap operations\n\ndEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8\nwas causing a remap operation like the below.\n\nop_remap: prev: 0000003fffed0000 00000000000f0000 00000000a5abd18a 0000000000000000\nop_remap: next:\nop_remap: unmap: 0000003fffed0000 0000000000100000 0\nop_map: map: 0000003ffffc0000 0000000000010000 000000005b1ba33c 00000000000e0000\n\nThis was resulting in an unmap operation from 0x3fffed0000+0xf0000, 0x100000\nwhich was corrupting the pagetables and oopsing the kernel.\n\nFixes the prev + unmap range calcs to use start/end and map back to addr/range.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-36018 was patched at 2024-07-11, 2024-07-16
152. Memory Corruption - Linux Kernel (CVE-2024-36019) - Medium [263]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: regmap: maple: Fix cache corruption in regcache_maple_drop() When keeping the upper end of a cache block entry, the entry[] array must be indexed by the offset from the base register of the block, i.e. max - mas.index. The code was indexing entry[] by only the register address, leading to an out-of-bounds access that copied some part of the kernel memory over the cache contents. This bug was not detected by the regmap KUnit test because it only tests with a block of registers starting at 0, so mas.index == 0.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nregmap: maple: Fix cache corruption in regcache_maple_drop()\n\nWhen keeping the upper end of a cache block entry, the entry[] array\nmust be indexed by the offset from the base register of the block,\ni.e. max - mas.index.\n\nThe code was indexing entry[] by only the register address, leading\nto an out-of-bounds access that copied some part of the kernel\nmemory over the cache contents.\n\nThis bug was not detected by the regmap KUnit test because it only\ntests with a block of registers starting at 0, so mas.index == 0.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-36019 was patched at 2024-07-11, 2024-07-16
153. Memory Corruption - Linux Kernel (CVE-2024-36979) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-36979 was patched at 2024-06-30
154. Memory Corruption - Linux Kernel (CVE-2024-38554) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38554 was patched at 2024-06-30
155. Memory Corruption - Linux Kernel (CVE-2024-38561) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38561 was patched at 2024-06-30
156. Memory Corruption - Linux Kernel (CVE-2024-38570) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38570 was patched at 2024-06-30
157. Memory Corruption - Linux Kernel (CVE-2024-38576) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38576 was patched at 2024-06-30
158. Memory Corruption - Linux Kernel (CVE-2024-38577) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38577 was patched at 2024-06-30
159. Memory Corruption - Linux Kernel (CVE-2024-38581) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38581 was patched at 2024-06-30
160. Memory Corruption - Linux Kernel (CVE-2024-38602) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38602 was patched at 2024-06-30
161. Memory Corruption - Linux Kernel (CVE-2024-38603) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38603 was patched at 2024-06-30
162. Memory Corruption - Linux Kernel (CVE-2024-38628) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38628 was patched at 2024-06-30
163. Memory Corruption - Linux Kernel (CVE-2024-38630) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38630 was patched at 2024-06-30
164. Memory Corruption - Linux Kernel (CVE-2024-38632) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38632 was patched at 2024-06-30
165. Memory Corruption - Linux Kernel (CVE-2024-39463) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-39463 was patched at 2024-06-30
166. Memory Corruption - Linux Kernel (CVE-2024-39487) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-39487 was patched at 2024-07-16
167. Memory Corruption - Linux Kernel (CVE-2024-39490) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-39490 was patched at 2024-07-16
168. Memory Corruption - Linux Kernel (CVE-2024-39494) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-39494 was patched at 2024-07-16
169. Memory Corruption - Linux Kernel (CVE-2024-39496) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-39496 was patched at 2024-07-16
170. Memory Corruption - Linux Kernel (CVE-2024-39510) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-39510 was patched at 2024-07-16
171. Memory Corruption - Linux Kernel (CVE-2024-40899) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-40899 was patched at 2024-07-16
172. Memory Corruption - Linux Kernel (CVE-2024-40900) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-40900 was patched at 2024-07-16
173. Memory Corruption - Linux Kernel (CVE-2024-40903) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-40903 was patched at 2024-07-16
174. Memory Corruption - Linux Kernel (CVE-2024-40910) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-40910 was patched at 2024-07-16
175. Memory Corruption - Linux Kernel (CVE-2024-40918) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-40918 was patched at 2024-07-16
176. Memory Corruption - Linux Kernel (CVE-2024-40920) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-40920 was patched at 2024-07-16
177. Memory Corruption - Linux Kernel (CVE-2024-40954) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-40954 was patched at 2024-07-16
178. Memory Corruption - Linux Kernel (CVE-2024-40973) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-40973 was patched at 2024-07-16
179. Memory Corruption - Linux Kernel (CVE-2024-40997) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-40997 was patched at 2024-07-16
180. Memory Corruption - Linux Kernel (CVE-2024-41001) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-41001 was patched at 2024-07-16
181. Memory Corruption - Linux Kernel (CVE-2024-41002) - Medium [263]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-41002 was patched at 2024-07-16
182. Elevation of Privilege - Unknown Product (CVE-2024-39684) - Medium [258]
Description: {'nvd_cve_data_all': 'Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.85 | 15 | Elevation of Privilege | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-39684 was patched at 2024-07-16
183. Unknown Vulnerability Type - Linux Kernel (CVE-2024-27021) - Medium [257]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: r8169: fix LED-related deadlock on module removal Binding devm_led_classdev_register() to the netdev is problematic because on module removal we get a RTNL-related deadlock. Fix this by avoiding the device-managed LED functions. Note: We can safely call led_classdev_unregister() for a LED even if registering it failed, because led_classdev_unregister() detects this and is a no-op in this case.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nr8169: fix LED-related deadlock on module removal\n\nBinding devm_led_classdev_register() to the netdev is problematic\nbecause on module removal we get a RTNL-related deadlock. Fix this\nby avoiding the device-managed LED functions.\n\nNote: We can safely call led_classdev_unregister() for a LED even\nif registering it failed, because led_classdev_unregister() detects\nthis and is a no-op in this case.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.8 | 10 | CVSS Base Score is 7.8. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
ubuntu: CVE-2024-27021 was patched at 2024-07-11, 2024-07-16
184. Information Disclosure - Unknown Product (CVE-2024-22232) - Medium [255]
Description: {'nvd_cve_data_all': 'A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A specially crafted url can be created which leads to a directory traversal in the salt file server.\nA malicious user can read an arbitrary file from a Salt master’s filesystem.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.83 | 15 | Information Disclosure | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.7. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-22232 was patched at 2024-06-30
redos: CVE-2024-22232 was patched at 2024-06-26
185. Unknown Vulnerability Type - OpenSSH (CVE-2024-39894) - Medium [252]
Description: {'nvd_cve_data_all': 'OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.8 | 14 | OpenSSH is a suite of secure networking utilities based on the Secure Shell protocol, which provides a secure channel over an unsecured network in a client–server architecture | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
redos: CVE-2024-39894 was patched at 2024-07-04
ubuntu: CVE-2024-39894 was patched at 2024-07-09
186. Incorrect Calculation - Linux Kernel (CVE-2022-48837) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2022-48837 was patched at 2024-07-16
187. Incorrect Calculation - Linux Kernel (CVE-2024-41000) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Incorrect Calculation | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-41000 was patched at 2024-07-15, 2024-07-16
188. Memory Corruption - Linux Kernel (CVE-2021-47576) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2021-47576 was patched at 2024-06-30
189. Memory Corruption - Linux Kernel (CVE-2021-47586) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2021-47586 was patched at 2024-06-30
190. Memory Corruption - Linux Kernel (CVE-2021-47589) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2021-47589 was patched at 2024-06-30
191. Memory Corruption - Linux Kernel (CVE-2021-47604) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2021-47604 was patched at 2024-06-30
192. Memory Corruption - Linux Kernel (CVE-2021-47605) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2021-47605 was patched at 2024-06-30
193. Memory Corruption - Linux Kernel (CVE-2021-47609) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2021-47609 was patched at 2024-06-30
194. Memory Corruption - Linux Kernel (CVE-2021-47613) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2021-47613 was patched at 2024-06-30
195. Memory Corruption - Linux Kernel (CVE-2021-47616) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2021-47616 was patched at 2024-06-30
196. Memory Corruption - Linux Kernel (CVE-2022-48724) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2022-48724 was patched at 2024-06-30
197. Memory Corruption - Linux Kernel (CVE-2022-48742) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2022-48742 was patched at 2024-06-30
198. Memory Corruption - Linux Kernel (CVE-2022-48753) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2022-48753 was patched at 2024-06-30
199. Memory Corruption - Linux Kernel (CVE-2022-48764) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2022-48764 was patched at 2024-06-30
200. Memory Corruption - Linux Kernel (CVE-2022-48771) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2022-48771 was patched at 2024-06-30
201. Memory Corruption - Linux Kernel (CVE-2022-48775) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2022-48775 was patched at 2024-07-16
202. Memory Corruption - Linux Kernel (CVE-2022-48779) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2022-48779 was patched at 2024-07-16
203. Memory Corruption - Linux Kernel (CVE-2022-48787) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2022-48787 was patched at 2024-07-16
204. Memory Corruption - Linux Kernel (CVE-2022-48788) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2022-48788 was patched at 2024-07-16
205. Memory Corruption - Linux Kernel (CVE-2022-48790) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2022-48790 was patched at 2024-07-16
206. Memory Corruption - Linux Kernel (CVE-2022-48809) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2022-48809 was patched at 2024-07-16
207. Memory Corruption - Linux Kernel (CVE-2022-48822) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2022-48822 was patched at 2024-07-16
208. Memory Corruption - Linux Kernel (CVE-2022-48838) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2022-48838 was patched at 2024-07-16
209. Memory Corruption - Linux Kernel (CVE-2022-48857) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2022-48857 was patched at 2024-07-16
210. Memory Corruption - Linux Kernel (CVE-2023-52885) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2023-52885 was patched at 2024-07-16
211. Memory Corruption - Linux Kernel (CVE-2023-52886) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2023-52886 was patched at 2024-07-16
212. Memory Corruption - Linux Kernel (CVE-2024-26991) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
ubuntu: CVE-2024-26991 was patched at 2024-07-11, 2024-07-16
213. Memory Corruption - Linux Kernel (CVE-2024-27007) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
ubuntu: CVE-2024-27007 was patched at 2024-07-11, 2024-07-16
214. Memory Corruption - Linux Kernel (CVE-2024-36978) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-36978 was patched at 2024-06-30, 2024-07-15, 2024-07-16
215. Memory Corruption - Linux Kernel (CVE-2024-38548) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-38548 was patched at 2024-06-30, 2024-07-15
216. Memory Corruption - Linux Kernel (CVE-2024-38550) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-38550 was patched at 2024-06-30
217. Memory Corruption - Linux Kernel (CVE-2024-38552) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-38552 was patched at 2024-06-30, 2024-07-15
218. Memory Corruption - Linux Kernel (CVE-2024-38555) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-38555 was patched at 2024-06-30, 2024-07-15
219. Memory Corruption - Linux Kernel (CVE-2024-38583) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-38583 was patched at 2024-06-30, 2024-07-15
220. Memory Corruption - Linux Kernel (CVE-2024-38588) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-38588 was patched at 2024-06-30
221. Memory Corruption - Linux Kernel (CVE-2024-38596) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-38596 was patched at 2024-06-30, 2024-07-15
222. Memory Corruption - Linux Kernel (CVE-2024-38608) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-38608 was patched at 2024-06-30
223. Memory Corruption - Linux Kernel (CVE-2024-38610) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-38610 was patched at 2024-06-30
224. Memory Corruption - Linux Kernel (CVE-2024-38619) - Medium [251]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alauda_read_data() and alauda_write_lba(). - Add a member "media_initialized" to struct alauda_info. - Change a condition in alauda_check_media() to ensure the first initialization. - Add an error check for the return value of alauda_init_media().', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nusb-storage: alauda: Check whether the media is initialized\n\nThe member "uzonesize" of struct alauda_info will remain 0\nif alauda_init_media() fails, potentially causing divide errors\nin alauda_read_data() and alauda_write_lba().\n- Add a member "media_initialized" to struct alauda_info.\n- Change a condition in alauda_check_media() to ensure the\n first initialization.\n- Add an error check for the return value of alauda_init_media().', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-38619 was patched at 2024-06-30, 2024-07-15, 2024-07-16
225. Memory Corruption - Linux Kernel (CVE-2024-38621) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-38621 was patched at 2024-06-30, 2024-07-15
226. Memory Corruption - Linux Kernel (CVE-2024-39471) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-39471 was patched at 2024-06-30, 2024-07-15
227. Memory Corruption - Linux Kernel (CVE-2024-39493) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-39493 was patched at 2024-07-15, 2024-07-16
228. Memory Corruption - Linux Kernel (CVE-2024-39495) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-39495 was patched at 2024-07-15, 2024-07-16
229. Memory Corruption - Linux Kernel (CVE-2024-39501) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-39501 was patched at 2024-07-15, 2024-07-16
230. Memory Corruption - Linux Kernel (CVE-2024-39503) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-39503 was patched at 2024-07-15, 2024-07-16
231. Memory Corruption - Linux Kernel (CVE-2024-40902) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-40902 was patched at 2024-07-15, 2024-07-16
232. Memory Corruption - Linux Kernel (CVE-2024-40932) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-40932 was patched at 2024-07-15, 2024-07-16
233. Memory Corruption - Linux Kernel (CVE-2024-40934) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-40934 was patched at 2024-07-15, 2024-07-16
234. Memory Corruption - Linux Kernel (CVE-2024-40958) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-40958 was patched at 2024-07-15, 2024-07-16
235. Memory Corruption - Linux Kernel (CVE-2024-40976) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-40976 was patched at 2024-07-15, 2024-07-16
236. Memory Corruption - Linux Kernel (CVE-2024-41005) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-41005 was patched at 2024-07-15, 2024-07-16
237. Memory Corruption - Linux Kernel (CVE-2024-41006) - Medium [251]
Description: In the
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.13419 |
debian: CVE-2024-41006 was patched at 2024-07-15, 2024-07-16
238. Cross Site Scripting - Unknown Product (CVE-2024-6307) - Medium [250]
Description: {'nvd_cve_data_all': 'WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.8 | 15 | Cross Site Scripting | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 6.4. According to NVD data source | |
0.3 | 10 | EPSS Probability is 0.00068, EPSS Percentile is 0.30327 |
debian: CVE-2024-6307 was patched at 2024-06-30
239. Memory Corruption - Mozilla Firefox (CVE-2024-6601) - Medium [246]
Description: A
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-6601 was patched at 2024-07-10, 2024-07-16
oraclelinux: CVE-2024-6601 was patched at 2024-07-11
redhat: CVE-2024-6601 was patched at 2024-07-11, 2024-07-17
ubuntu: CVE-2024-6601 was patched at 2024-07-10
240. Memory Corruption - Mozilla Firefox (CVE-2024-6604) - Medium [246]
Description: Memory safety bugs present in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-6604 was patched at 2024-07-10, 2024-07-16
oraclelinux: CVE-2024-6604 was patched at 2024-07-11
redhat: CVE-2024-6604 was patched at 2024-07-11, 2024-07-17
ubuntu: CVE-2024-6604 was patched at 2024-07-10
241. Memory Corruption - Mozilla Firefox (CVE-2024-6615) - Medium [246]
Description: Memory safety bugs present in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
ubuntu: CVE-2024-6615 was patched at 2024-07-10
242. Denial of Service - Unknown Product (CVE-2024-24791) - Medium [244]
Description: {'nvd_cve_data_all': 'The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-24791 was patched at 2024-07-16
243. Denial of Service - Unknown Product (CVE-2024-37298) - Medium [244]
Description: {'nvd_cve_data_all': 'gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-37298 was patched at 2024-07-16
244. Denial of Service - Unknown Product (CVE-2024-38875) - Medium [244]
Description: {'nvd_cve_data_all': 'An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38875 was patched at 2024-07-16
ubuntu: CVE-2024-38875 was patched at 2024-07-09, 2024-07-11
245. Denial of Service - Unknown Product (CVE-2024-6716) - Medium [244]
Description: {'nvd_cve_data_all': 'A flaw was found in libtiff. This flaw allows an attacker to create a crafted tiff file, forcing libtiff to allocate memory indefinitely. This issue can result in a denial of service of the system consuming libtiff due to memory starvation.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A flaw was found in libtiff. This flaw allows an attacker to create a crafted tiff file, forcing libtiff to allocate memory indefinitely. This issue can result in a denial of service of the system consuming libtiff due to memory starvation.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-6716 was patched at 2024-07-16
246. Security Feature Bypass - Unknown Product (CVE-2024-33996) - Medium [244]
Description: {'nvd_cve_data_all': 'Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 6.2. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
redos: CVE-2024-33996 was patched at 2024-07-01
247. Denial of Service - GPAC (CVE-2024-6061) - Medium [239]
Description: A vulnerability has been found in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.3 | 10 | CVSS Base Score is 3.3. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-6061 was patched at 2024-06-30
248. Denial of Service - LLDP (CVE-2024-6501) - Medium [239]
Description: A flaw was found in NetworkManager. When a system running NetworkManager with DEBUG logs enabled and an interface eth1 configured with
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0.4 | 14 | LLDP is an industry standard protocol designed to supplant proprietary Link-Layer protocols such as Extreme's EDP (Extreme Discovery Protocol) and CDP (Cisco Discovery Protocol) | |
0.3 | 10 | CVSS Base Score is 3.1. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6501 was patched at 2024-07-16
249. Cross Site Scripting - Unknown Product (CVE-2024-21520) - Medium [238]
Description: {'nvd_cve_data_all': 'Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.8 | 15 | Cross Site Scripting | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 6.1. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-21520 was patched at 2024-06-30
250. Cross Site Scripting - Unknown Product (CVE-2024-31111) - Medium [238]
Description: {'nvd_cve_data_all': 'Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.8 | 15 | Cross Site Scripting | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 6.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-31111 was patched at 2024-06-30
251. Unknown Vulnerability Type - qt (CVE-2024-39936) - Medium [238]
Description: {'nvd_cve_data_all': 'An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted() signal has not yet been emitted and processed..', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.5 | 14 | Product detected by a:qt:qt (exists in CPE dict) | |
0.9 | 10 | CVSS Base Score is 8.6. According to NVD data source | |
0.4 | 10 | EPSS Probability is 0.00087, EPSS Percentile is 0.37504 |
debian: CVE-2024-39936 was patched at 2024-07-16
252. Memory Corruption - Chromium (CVE-2024-6772) - Medium [234]
Description: Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to perform
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6772 was patched at 2024-07-16
253. Memory Corruption - Chromium (CVE-2024-6773) - Medium [234]
Description: Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6773 was patched at 2024-07-16
254. Memory Corruption - Chromium (CVE-2024-6774) - Medium [234]
Description: Use after free in Screen Capture in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6774 was patched at 2024-07-16
255. Memory Corruption - Chromium (CVE-2024-6775) - Medium [234]
Description: Use after free in Media Stream in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6775 was patched at 2024-07-16
256. Memory Corruption - Chromium (CVE-2024-6776) - Medium [234]
Description: Use after free in Audio in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6776 was patched at 2024-07-16
257. Memory Corruption - Chromium (CVE-2024-6777) - Medium [234]
Description: Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6777 was patched at 2024-07-16
258. Memory Corruption - Chromium (CVE-2024-6779) - Medium [234]
Description:
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Chromium is a free and open-source web browser project, mainly developed and maintained by Google | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-6779 was patched at 2024-07-16
259. Memory Corruption - Mozilla Firefox (CVE-2024-5694) - Medium [234]
Description: An attacker could have caused a
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
ubuntu: CVE-2024-5694 was patched at 2024-07-03
260. Memory Corruption - Mozilla Firefox (CVE-2024-5695) - Medium [234]
Description: If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been triggered, and in rarer situations,
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
ubuntu: CVE-2024-5695 was patched at 2024-07-03
261. Memory Corruption - Mozilla Firefox (CVE-2024-5701) - Medium [234]
Description: Memory safety bugs present in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
ubuntu: CVE-2024-5701 was patched at 2024-07-03
262. Unknown Vulnerability Type - Linux Kernel (CVE-2024-38780) - Medium [233]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: dma-buf/sw-sync: don't enable IRQ from sync_print_obj() Since commit a6aa8fca4d79 ("dma-buf/sw-sync: Reduce irqsave/irqrestore from known context") by error replaced spin_unlock_irqrestore() with spin_unlock_irq() for both sync_debugfs_show() and sync_print_obj() despite sync_print_obj() is called from sync_debugfs_show(), lockdep complains inconsistent lock state warning. Use plain spin_{lock,unlock}() for sync_print_obj(), for sync_debugfs_show() is already using spin_{lock,unlock}_irq().', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/sw-sync: don't enable IRQ from sync_print_obj()\n\nSince commit a6aa8fca4d79 ("dma-buf/sw-sync: Reduce irqsave/irqrestore from\nknown context") by error replaced spin_unlock_irqrestore() with\nspin_unlock_irq() for both sync_debugfs_show() and sync_print_obj() despite\nsync_print_obj() is called from sync_debugfs_show(), lockdep complains\ninconsistent lock state warning.\n\nUse plain spin_{lock,unlock}() for sync_print_obj(), for\nsync_debugfs_show() is already using spin_{lock,unlock}_irq().', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-38780 was patched at 2024-06-30, 2024-07-15
263. Unknown Vulnerability Type - Linux Kernel (CVE-2024-39476) - Medium [233]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING Xiao reported that lvm2 test lvconvert-raid-takeover.sh can hang with small possibility, the root cause is exactly the same as commit bed9e27baf52 ("Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"") However, Dan reported another hang after that, and junxiao investigated the problem and found out that this is caused by plugged bio can't issue from raid5d(). Current implementation in raid5d() has a weird dependence: 1) md_check_recovery() from raid5d() must hold 'reconfig_mutex' to clear MD_SB_CHANGE_PENDING; 2) raid5d() handles IO in a deadloop, until all IO are issued; 3) IO from raid5d() must wait for MD_SB_CHANGE_PENDING to be cleared; This behaviour is introduce before v2.6, and for consequence, if other context hold 'reconfig_mutex', and md_check_recovery() can't update super_block, then raid5d() will waste one cpu 100% by the deadloop, until 'reconfig_mutex' is released. Refer to the implementation from raid1 and raid10, fix this problem by skipping issue IO if MD_SB_CHANGE_PENDING is still set after md_check_recovery(), daemon thread will be woken up when 'reconfig_mutex' is released. Meanwhile, the hang problem will be fixed as well.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING\n\nXiao reported that lvm2 test lvconvert-raid-takeover.sh can hang with\nsmall possibility, the root cause is exactly the same as commit\nbed9e27baf52 ("Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"")\n\nHowever, Dan reported another hang after that, and junxiao investigated\nthe problem and found out that this is caused by plugged bio can't issue\nfrom raid5d().\n\nCurrent implementation in raid5d() has a weird dependence:\n\n1) md_check_recovery() from raid5d() must hold 'reconfig_mutex' to clear\n MD_SB_CHANGE_PENDING;\n2) raid5d() handles IO in a deadloop, until all IO are issued;\n3) IO from raid5d() must wait for MD_SB_CHANGE_PENDING to be cleared;\n\nThis behaviour is introduce before v2.6, and for consequence, if other\ncontext hold 'reconfig_mutex', and md_check_recovery() can't update\nsuper_block, then raid5d() will waste one cpu 100% by the deadloop, until\n'reconfig_mutex' is released.\n\nRefer to the implementation from raid1 and raid10, fix this problem by\nskipping issue IO if MD_SB_CHANGE_PENDING is still set after\nmd_check_recovery(), daemon thread will be woken up when 'reconfig_mutex'\nis released. Meanwhile, the hang problem will be fixed as well.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-39476 was patched at 2024-07-15, 2024-07-16
264. Unknown Vulnerability Type - Linux Kernel (CVE-2024-39481) - Medium [233]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: media: mc: Fix graph walk in media_pipeline_start The graph walk tries to follow all links, even if they are not between pads. This causes a crash with, e.g. a MEDIA_LNK_FL_ANCILLARY_LINK link. Fix this by allowing the walk to proceed only for MEDIA_LNK_FL_DATA_LINK links.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mc: Fix graph walk in media_pipeline_start\n\nThe graph walk tries to follow all links, even if they are not between\npads. This causes a crash with, e.g. a MEDIA_LNK_FL_ANCILLARY_LINK link.\n\nFix this by allowing the walk to proceed only for MEDIA_LNK_FL_DATA_LINK\nlinks.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00042, EPSS Percentile is 0.05058 |
debian: CVE-2024-39481 was patched at 2024-07-16
265. Denial of Service - Unknown Product (CVE-2024-37795) - Medium [232]
Description: {'nvd_cve_data_all': 'A segmentation fault in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT-LIB input file containing the `set-logic` command with specific formatting errors.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A segmentation fault in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT-LIB input file containing the `set-logic` command with specific formatting errors.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-37795 was patched at 2024-06-30
266. Denial of Service - Unknown Product (CVE-2024-39134) - Medium [232]
Description: {'nvd_cve_data_all': 'A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /zzip/zip.c.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer() function at /zzip/zip.c.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.8 | 10 | CVSS Base Score is 7.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-39134 was patched at 2024-06-30
267. Memory Corruption - Unknown Product (CVE-2024-38441) - Medium [232]
Description: {'nvd_cve_data_all': 'Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\\0' in FPMapName in afp_mapname in etc/afpd/directory.c. 2.4.1 and 3.1.19 are also fixed versions.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\\0' in FPMapName in afp_mapname in etc/afpd/directory.c. 2.4.1 and 3.1.19 are also fixed versions.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
1.0 | 10 | CVSS Base Score is 9.8. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38441 was patched at 2024-06-30
268. Security Feature Bypass - Unknown Product (CVE-2024-39312) - Medium [232]
Description: {'nvd_cve_data_all': 'Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the permitted subtree would be checked. If a certificate included a name which was permitted by the permitted subtree but also excluded by excluded subtree, it would be accepted. Fixed in versions 3.5.0 and 2.19.5.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.3. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-39312 was patched at 2024-07-16
269. Information Disclosure - Unknown Product (CVE-2024-34003) - Medium [231]
Description: {'nvd_cve_data_all': 'In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.83 | 15 | Information Disclosure | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.9. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
redos: CVE-2024-34003 was patched at 2024-07-01
270. Memory Corruption - GPAC (CVE-2024-6064) - Medium [227]
Description: A vulnerability was found in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.5 | 10 | CVSS Base Score is 5.3. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-6064 was patched at 2024-06-30
271. Unknown Vulnerability Type - Linux Kernel (CVE-2024-38662) - Medium [221]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: bpf: Allow delete from sockmap/sockhash only if update is allowed We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a map_delete on a sockmap/sockhash. We don't intend to support this artificial use scenario. Extend the existing verifier allowed-program-type check for updating sockmap/sockhash to also cover deleting from a map. From now on only BPF programs which were previously allowed to update sockmap/sockhash can delete from these map types.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Allow delete from sockmap/sockhash only if update is allowed\n\nWe have seen an influx of syzkaller reports where a BPF program attached to\na tracepoint triggers a locking rule violation by performing a map_delete\non a sockmap/sockhash.\n\nWe don't intend to support this artificial use scenario. Extend the\nexisting verifier allowed-program-type check for updating sockmap/sockhash\nto also cover deleting from a map.\n\nFrom now on only BPF programs which were previously allowed to update\nsockmap/sockhash can delete from these map types.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.5 | 10 | CVSS Base Score is 4.7. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.10161 |
debian: CVE-2024-38662 was patched at 2024-06-30, 2024-07-15
272. Denial of Service - Unknown Product (CVE-2023-39329) - Medium [220]
Description: {'nvd_cve_data_all': 'A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 6.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2023-39329 was patched at 2024-07-16
273. Denial of Service - Unknown Product (CVE-2024-38949) - Medium [220]
Description: {'nvd_cve_data_all': 'Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 6.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-38949 was patched at 2024-06-30
274. Security Feature Bypass - Unknown Product (CVE-2024-38531) - Medium [220]
Description: {'nvd_cve_data_all': 'Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Nix is a package manager for Linux and other Unix systems that makes package management reliable and reproducible. A build process has access to and can change the permissions of the build directory. After creating a setuid binary in a globally accessible location, a malicious local user can assume the permissions of a Nix daemon worker and hijack all future builds. This issue was patched in version(s) 2.23.1, 2.22.2, 2.21.3, 2.20.7, 2.19.5 and 2.18.4.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.9 | 15 | Security Feature Bypass | |
0 | 14 | Unknown Product | |
0.4 | 10 | CVSS Base Score is 3.6. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-38531 was patched at 2024-06-30
275. Information Disclosure - Unknown Product (CVE-2024-40630) - Medium [219]
Description: {'nvd_cve_data_all': 'OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in `HeifInput::seek_subimage()`. In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the `ImageInput` APIs. This bug has been addressed in commit `0a2dcb4c` which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in `HeifInput::seek_subimage()`. In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the `ImageInput` APIs. This bug has been addressed in commit `0a2dcb4c` which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.83 | 15 | Information Disclosure | |
0 | 14 | Unknown Product | |
0.4 | 10 | CVSS Base Score is 4.3. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-40630 was patched at 2024-07-16
276. Spoofing - Mozilla Firefox (CVE-2024-5698) - Medium [216]
Description: By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user confusion and possible
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.4 | 15 | Spoofing | |
0.8 | 14 | Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
ubuntu: CVE-2024-5698 was patched at 2024-07-03
277. Denial of Service - Unknown Product (CVE-2023-39328) - Medium [208]
Description: {'nvd_cve_data_all': 'A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 5.5. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2023-39328 was patched at 2024-07-16
278. Denial of Service - Unknown Product (CVE-2024-34702) - Medium [208]
Description: {'nvd_cve_data_all': 'Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. Prior to 3.5.0 and 2.19.5, checking name constraints in X.509 certificates is quadratic in the number of names and name constraints. An attacker who presented a certificate chain which contained a very large number of names in the SubjectAlternativeName, signed by a CA certificate which contained a large number of name constraints, could cause a denial of service. The problem has been addressed in Botan 3.5.0 and a partial backport has also been applied and is included in Botan 2.19.5.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.3. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.17474 |
debian: CVE-2024-34702 was patched at 2024-07-16
279. Denial of Service - Unknown Product (CVE-2024-37894) - Medium [208]
Description: {'nvd_cve_data_all': 'Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.6 | 10 | CVSS Base Score is 6.3. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-37894 was patched at 2024-06-30
280. Memory Corruption - GPAC (CVE-2024-6062) - Medium [203]
Description: A vulnerability was found in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.3 | 10 | CVSS Base Score is 3.3. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-6062 was patched at 2024-06-30
281. Memory Corruption - GPAC (CVE-2024-6063) - Medium [203]
Description: A vulnerability was found in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.4 | 14 | GPAC is an Open Source multimedia framework for research and academic purposes; the project covers different aspects of multimedia, with a focus on presentation technologies (graphics, animation and interactivity) | |
0.3 | 10 | CVSS Base Score is 3.3. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10617 |
debian: CVE-2024-6063 was patched at 2024-06-30
282. Memory Corruption - 7-Zip (CVE-2023-52169) - Low [196]
Description: The NtfsHandler.cpp NTFS handler in
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0.5 | 14 | 7-Zip is a free and open-source file archiver, a utility used to place groups of files within compressed containers known as "archives" | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2023-52169 was patched at 2024-07-16
redos: CVE-2023-52169 was patched at 2024-07-13
283. Memory Corruption - Unknown Product (CVE-2024-32760) - Low [196]
Description: {'nvd_cve_data_all': 'When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.5 | 15 | Memory Corruption | |
0 | 14 | Unknown Product | |
0.7 | 10 | CVSS Base Score is 6.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
redos: CVE-2024-32760 was patched at 2024-07-03
284. Path Traversal - Unknown Product (CVE-2024-22231) - Low [196]
Description: {'nvd_cve_data_all': 'Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead\xa0a malicious attacker to create an arbitrary directory on a Salt master.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead\xa0a malicious attacker to create an arbitrary directory on a Salt master.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Path Traversal | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.0. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-22231 was patched at 2024-06-30
redos: CVE-2024-22231 was patched at 2024-06-26
285. Path Traversal - Unknown Product (CVE-2024-32111) - Low [196]
Description: {'nvd_cve_data_all': 'Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Path Traversal | |
0 | 14 | Unknown Product | |
0.5 | 10 | CVSS Base Score is 5.0. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00044, EPSS Percentile is 0.10827 |
debian: CVE-2024-32111 was patched at 2024-06-30
286. Unknown Vulnerability Type - Cinder (CVE-2024-32498) - Low [190]
Description: {'nvd_cve_data_all': 'An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.5 | 14 | Product detected by a:openstack:cinder (exists in CPE dict) | |
0.7 | 10 | CVSS Base Score is 6.5. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00049, EPSS Percentile is 0.1854 |
debian: CVE-2024-32498 was patched at 2024-07-16
redhat: CVE-2024-32498 was patched at 2024-07-02, 2024-07-09
ubuntu: CVE-2024-32498 was patched at 2024-07-08
287. Denial of Service - Unknown Product (CVE-2023-39327) - Low [184]
Description: {'nvd_cve_data_all': 'A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.4 | 10 | CVSS Base Score is 4.3. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2023-39327 was patched at 2024-07-16
288. Denial of Service - Unknown Product (CVE-2024-39133) - Low [184]
Description: {'nvd_cve_data_all': 'Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() function at /zzip/zip.c.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0.7 | 15 | Denial of Service | |
0 | 14 | Unknown Product | |
0.4 | 10 | CVSS Base Score is 4.3. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-39133 was patched at 2024-06-30
289. Unknown Vulnerability Type - Oracle Java SE (CVE-2024-21140) - Low [183]
Description: {'nvd_cve_data_all': 'Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.6 | 14 | Oracle Java SE | |
0.5 | 10 | CVSS Base Score is 4.8. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00046, EPSS Percentile is 0.17374 |
redhat: CVE-2024-21140 was patched at 2024-07-17
290. Unknown Vulnerability Type - Perl (CVE-2024-39900) - Low [183]
Description: {'nvd_cve_data_all': 'OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.6 | 14 | Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages | |
0.5 | 10 | CVSS Base Score is 5.4. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
redos: CVE-2024-39900 was patched at 2024-07-16
291. Unknown Vulnerability Type - Perl (CVE-2024-39901) - Low [183]
Description: {'nvd_cve_data_all': 'OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.6 | 14 | Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages | |
0.5 | 10 | CVSS Base Score is 5.4. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
redos: CVE-2024-39901 was patched at 2024-07-16
292. Unknown Vulnerability Type - Node.js (CVE-2024-22018) - Low [180]
Description: {'nvd_cve_data_all': 'A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.8 | 14 | Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more | |
0.3 | 10 | CVSS Base Score is 2.9. According to NVD data source | |
0.1 | 10 | EPSS Probability is 0.00043, EPSS Percentile is 0.09291 |
debian: CVE-2024-22018 was patched at 2024-07-16
293. Unknown Vulnerability Type - Node.js (CVE-2024-38372) - Low [180]
Description: {'nvd_cve_data_all': 'Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` might include portion of memory from the Node.js process. This has been patched in v6.19.2.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.8 | 14 | Node.js is a cross-platform, open-source server environment that can run on Windows, Linux, Unix, macOS, and more | |
0.2 | 10 | CVSS Base Score is 2.0. According to NVD data source | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2024-38372 was patched at 2024-07-16
294. Remote Code Execution - Unknown Product (CVE-2024-29421) - Low [178]
Description: {'nvd_cve_data_all': 'xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker to execute arbitrary code.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker to execute arbitrary code.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
1.0 | 15 | Remote Code Execution | |
0 | 14 | Unknown Product | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0 | 10 | EPSS Probability is 0, EPSS Percentile is 0 |
debian: CVE-2024-29421 was patched at 2024-07-16
295. Unknown Vulnerability Type - Linux Kernel (CVE-2016-20022) - Low [173]
Description: {'nvd_cve_data_all': 'In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize field of an endpoint descriptor. NOTE: This vulnerability only affects products that are no longer supported by the supplier.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize field of an endpoint descriptor. NOTE: This vulnerability only affects products that are no longer supported by the supplier.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2016-20022 was patched at 2024-06-30
296. Unknown Vulnerability Type - Linux Kernel (CVE-2021-47578) - Low [173]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Don't call kcalloc() if size arg is zero If the size arg to kcalloc() is zero, it returns ZERO_SIZE_PTR. Because of that, for a following NULL pointer check to work on the returned pointer, kcalloc() must not be called with the size arg equal to zero. Return early without error before the kcalloc() call if size arg is zero. BUG: KASAN: null-ptr-deref in memcpy include/linux/fortify-string.h:191 [inline] BUG: KASAN: null-ptr-deref in sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974 Write of size 4 at addr 0000000000000010 by task syz-executor.1/22789 CPU: 1 PID: 22789 Comm: syz-executor.1 Not tainted 5.15.0-syzk #1 Hardware name: Red Hat KVM, BIOS 1.13.0-2 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106 __kasan_report mm/kasan/report.c:446 [inline] kasan_report.cold.14+0x112/0x117 mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189 memcpy+0x3b/0x60 mm/kasan/shadow.c:66 memcpy include/linux/fortify-string.h:191 [inline] sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974 do_dout_fetch drivers/scsi/scsi_debug.c:2954 [inline] do_dout_fetch drivers/scsi/scsi_debug.c:2946 [inline] resp_verify+0x49e/0x930 drivers/scsi/scsi_debug.c:4276 schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478 scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533 scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline] scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699 blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639 __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325 blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358 __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761 __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1838 blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891 blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474 blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62 blk_execute_rq+0xdb/0x360 block/blk-exec.c:102 sg_scsi_ioctl drivers/scsi/scsi_ioctl.c:621 [inline] scsi_ioctl+0x8bb/0x15c0 drivers/scsi/scsi_ioctl.c:930 sg_ioctl_common+0x172d/0x2710 drivers/scsi/sg.c:1112 sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Don't call kcalloc() if size arg is zero\n\nIf the size arg to kcalloc() is zero, it returns ZERO_SIZE_PTR. Because of\nthat, for a following NULL pointer check to work on the returned pointer,\nkcalloc() must not be called with the size arg equal to zero. Return early\nwithout error before the kcalloc() call if size arg is zero.\n\nBUG: KASAN: null-ptr-deref in memcpy include/linux/fortify-string.h:191 [inline]\nBUG: KASAN: null-ptr-deref in sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974\nWrite of size 4 at addr 0000000000000010 by task syz-executor.1/22789\n\nCPU: 1 PID: 22789 Comm: syz-executor.1 Not tainted 5.15.0-syzk #1\nHardware name: Red Hat KVM, BIOS 1.13.0-2\nCall Trace:\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\n __kasan_report mm/kasan/report.c:446 [inline]\n kasan_report.cold.14+0x112/0x117 mm/kasan/report.c:459\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189\n memcpy+0x3b/0x60 mm/kasan/shadow.c:66\n memcpy include/linux/fortify-string.h:191 [inline]\n sg_copy_buffer+0x138/0x240 lib/scatterlist.c:974\n do_dout_fetch drivers/scsi/scsi_debug.c:2954 [inline]\n do_dout_fetch drivers/scsi/scsi_debug.c:2946 [inline]\n resp_verify+0x49e/0x930 drivers/scsi/scsi_debug.c:4276\n schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478\n scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533\n scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline]\n scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699\n blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639\n __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325\n blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358\n __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761\n __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1838\n blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891\n blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474\n blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62\n blk_execute_rq+0xdb/0x360 block/blk-exec.c:102\n sg_scsi_ioctl drivers/scsi/scsi_ioctl.c:621 [inline]\n scsi_ioctl+0x8bb/0x15c0 drivers/scsi/scsi_ioctl.c:930\n sg_ioctl_common+0x172d/0x2710 drivers/scsi/sg.c:1112\n sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:874 [inline]\n __se_sys_ioctl fs/ioctl.c:860 [inline]\n __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2021-47578 was patched at 2024-06-30
297. Unknown Vulnerability Type - Linux Kernel (CVE-2021-47579) - Low [173]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: ovl: fix warning in ovl_create_real() Syzbot triggered the following warning in ovl_workdir_create() -> ovl_create_real(): \tif (!err && WARN_ON(!newdentry->d_inode)) { The reason is that the cgroup2 filesystem returns from mkdir without instantiating the new dentry. Weird filesystems such as this will be rejected by overlayfs at a later stage during setup, but to prevent such a warning, call ovl_mkdir_real() directly from ovl_workdir_create() and reject this case early.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix warning in ovl_create_real()\n\nSyzbot triggered the following warning in ovl_workdir_create() ->\novl_create_real():\n\n\tif (!err && WARN_ON(!newdentry->d_inode)) {\n\nThe reason is that the cgroup2 filesystem returns from mkdir without\ninstantiating the new dentry.\n\nWeird filesystems such as this will be rejected by overlayfs at a later\nstage during setup, but to prevent such a warning, call ovl_mkdir_real()\ndirectly from ovl_workdir_create() and reject this case early.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2021-47579 was patched at 2024-06-30
298. Unknown Vulnerability Type - Linux Kernel (CVE-2021-47580) - Low [173]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix type in min_t to avoid stack OOB Change min_t() to use type "u32" instead of type "int" to avoid stack out of bounds. With min_t() type "int" the values get sign extended and the larger value gets used causing stack out of bounds. BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:191 [inline] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x1de/0x240 lib/scatterlist.c:976 Read of size 127 at addr ffff888072607128 by task syz-executor.7/18707 CPU: 1 PID: 18707 Comm: syz-executor.7 Not tainted 5.15.0-syzk #1 Hardware name: Red Hat KVM, BIOS 1.13.0-2 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106 print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:256 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189 memcpy+0x23/0x60 mm/kasan/shadow.c:65 memcpy include/linux/fortify-string.h:191 [inline] sg_copy_buffer+0x1de/0x240 lib/scatterlist.c:976 sg_copy_from_buffer+0x33/0x40 lib/scatterlist.c:1000 fill_from_dev_buffer.part.34+0x82/0x130 drivers/scsi/scsi_debug.c:1162 fill_from_dev_buffer drivers/scsi/scsi_debug.c:1888 [inline] resp_readcap16+0x365/0x3b0 drivers/scsi/scsi_debug.c:1887 schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478 scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533 scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline] scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699 blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639 __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325 blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358 __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761 __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1838 blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891 blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474 blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62 sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:836 sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:774 sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:939 sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix type in min_t to avoid stack OOB\n\nChange min_t() to use type "u32" instead of type "int" to avoid stack out\nof bounds. With min_t() type "int" the values get sign extended and the\nlarger value gets used causing stack out of bounds.\n\nBUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:191 [inline]\nBUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x1de/0x240 lib/scatterlist.c:976\nRead of size 127 at addr ffff888072607128 by task syz-executor.7/18707\n\nCPU: 1 PID: 18707 Comm: syz-executor.7 Not tainted 5.15.0-syzk #1\nHardware name: Red Hat KVM, BIOS 1.13.0-2\nCall Trace:\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106\n print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:256\n __kasan_report mm/kasan/report.c:442 [inline]\n kasan_report.cold.14+0x7d/0x117 mm/kasan/report.c:459\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0x1a3/0x210 mm/kasan/generic.c:189\n memcpy+0x23/0x60 mm/kasan/shadow.c:65\n memcpy include/linux/fortify-string.h:191 [inline]\n sg_copy_buffer+0x1de/0x240 lib/scatterlist.c:976\n sg_copy_from_buffer+0x33/0x40 lib/scatterlist.c:1000\n fill_from_dev_buffer.part.34+0x82/0x130 drivers/scsi/scsi_debug.c:1162\n fill_from_dev_buffer drivers/scsi/scsi_debug.c:1888 [inline]\n resp_readcap16+0x365/0x3b0 drivers/scsi/scsi_debug.c:1887\n schedule_resp+0x4d8/0x1a70 drivers/scsi/scsi_debug.c:5478\n scsi_debug_queuecommand+0x8c9/0x1ec0 drivers/scsi/scsi_debug.c:7533\n scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1520 [inline]\n scsi_queue_rq+0x16b0/0x2d40 drivers/scsi/scsi_lib.c:1699\n blk_mq_dispatch_rq_list+0xb9b/0x2700 block/blk-mq.c:1639\n __blk_mq_sched_dispatch_requests+0x28f/0x590 block/blk-mq-sched.c:325\n blk_mq_sched_dispatch_requests+0x105/0x190 block/blk-mq-sched.c:358\n __blk_mq_run_hw_queue+0xe5/0x150 block/blk-mq.c:1761\n __blk_mq_delay_run_hw_queue+0x4f8/0x5c0 block/blk-mq.c:1838\n blk_mq_run_hw_queue+0x18d/0x350 block/blk-mq.c:1891\n blk_mq_sched_insert_request+0x3db/0x4e0 block/blk-mq-sched.c:474\n blk_execute_rq_nowait+0x16b/0x1c0 block/blk-exec.c:62\n sg_common_write.isra.18+0xeb3/0x2000 drivers/scsi/sg.c:836\n sg_new_write.isra.19+0x570/0x8c0 drivers/scsi/sg.c:774\n sg_ioctl_common+0x14d6/0x2710 drivers/scsi/sg.c:939\n sg_ioctl+0xa2/0x180 drivers/scsi/sg.c:1165\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:874 [inline]\n __se_sys_ioctl fs/ioctl.c:860 [inline]\n __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2021-47580 was patched at 2024-06-30
299. Unknown Vulnerability Type - Linux Kernel (CVE-2021-47583) - Low [173]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: media: mxl111sf: change mutex_init() location Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized mutex. The problem was in wrong mutex_init() location. Previous mutex_init(&state->msg_lock) call was in ->init() function, but dvb_usbv2_init() has this order of calls: \tdvb_usbv2_init() \t dvb_usbv2_adapter_init() \t dvb_usbv2_adapter_frontend_init() \t props->frontend_attach() \t props->init() Since mxl111sf_* devices call mxl111sf_ctrl_msg() in ->frontend_attach() internally we need to initialize state->msg_lock before frontend_attach(). To achieve it, ->probe() call added to all mxl111sf_* devices, which will simply initiaize mutex.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mxl111sf: change mutex_init() location\n\nSyzbot reported, that mxl111sf_ctrl_msg() uses uninitialized\nmutex. The problem was in wrong mutex_init() location.\n\nPrevious mutex_init(&state->msg_lock) call was in ->init() function, but\ndvb_usbv2_init() has this order of calls:\n\n\tdvb_usbv2_init()\n\t dvb_usbv2_adapter_init()\n\t dvb_usbv2_adapter_frontend_init()\n\t props->frontend_attach()\n\n\t props->init()\n\nSince mxl111sf_* devices call mxl111sf_ctrl_msg() in ->frontend_attach()\ninternally we need to initialize state->msg_lock before\nfrontend_attach(). To achieve it, ->probe() call added to all mxl111sf_*\ndevices, which will simply initiaize mutex.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2021-47583 was patched at 2024-06-30
300. Unknown Vulnerability Type - Linux Kernel (CVE-2021-47584) - Low [173]
Description: {'nvd_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved: iocost: Fix divide-by-zero on donation from low hweight cgroup The donation calculation logic assumes that the donor has non-zero after-donation hweight, so the lowest active hweight a donating cgroup can have is 2 so that it can donate 1 while keeping the other 1 for itself. Earlier, we only donated from cgroups with sizable surpluses so this condition was always true. However, with the precise donation algorithm implemented, f1de2439ec43 ("blk-iocost: revamp donation amount determination") made the donation amount calculation exact enabling even low hweight cgroups to donate. This means that in rare occasions, a cgroup with active hweight of 1 can enter donation calculation triggering the following warning and then a divide-by-zero oops. WARNING: CPU: 4 PID: 0 at block/blk-iocost.c:1928 transfer_surpluses.cold+0x0/0x53 [884/94867] ... RIP: 0010:transfer_surpluses.cold+0x0/0x53 Code: 92 ff 48 c7 c7 28 d1 ab b5 65 48 8b 34 25 00 ae 01 00 48 81 c6 90 06 00 00 e8 8b 3f fe ff 48 c7 c0 ea ff ff ff e9 95 ff 92 ff <0f> 0b 48 c7 c7 30 da ab b5 e8 71 3f fe ff 4c 89 e8 4d 85 ed 74 0 4 ... Call Trace: <IRQ> ioc_timer_fn+0x1043/0x1390 call_timer_fn+0xa1/0x2c0 __run_timers.part.0+0x1ec/0x2e0 run_timer_softirq+0x35/0x70 ... iocg: invalid donation weights in /a/b: active=1 donating=1 after=0 Fix it by excluding cgroups w/ active hweight < 2 from donating. Excluding these extreme low hweight donations shouldn't affect work conservation in any meaningful way.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'In the Linux kernel, the following vulnerability has been resolved:\n\niocost: Fix divide-by-zero on donation from low hweight cgroup\n\nThe donation calculation logic assumes that the donor has non-zero\nafter-donation hweight, so the lowest active hweight a donating cgroup can\nhave is 2 so that it can donate 1 while keeping the other 1 for itself.\nEarlier, we only donated from cgroups with sizable surpluses so this\ncondition was always true. However, with the precise donation algorithm\nimplemented, f1de2439ec43 ("blk-iocost: revamp donation amount\ndetermination") made the donation amount calculation exact enabling even low\nhweight cgroups to donate.\n\nThis means that in rare occasions, a cgroup with active hweight of 1 can\nenter donation calculation triggering the following warning and then a\ndivide-by-zero oops.\n\n WARNING: CPU: 4 PID: 0 at block/blk-iocost.c:1928 transfer_surpluses.cold+0x0/0x53 [884/94867]\n ...\n RIP: 0010:transfer_surpluses.cold+0x0/0x53\n Code: 92 ff 48 c7 c7 28 d1 ab b5 65 48 8b 34 25 00 ae 01 00 48 81 c6 90 06 00 00 e8 8b 3f fe ff 48 c7 c0 ea ff ff ff e9 95 ff 92 ff <0f> 0b 48 c7 c7 30 da ab b5 e8 71 3f fe ff 4c 89 e8 4d 85 ed 74 0\n4\n ...\n Call Trace:\n <IRQ>\n ioc_timer_fn+0x1043/0x1390\n call_timer_fn+0xa1/0x2c0\n __run_timers.part.0+0x1ec/0x2e0\n run_timer_softirq+0x35/0x70\n ...\n iocg: invalid donation weights in /a/b: active=1 donating=1 after=0\n\nFix it by excluding cgroups w/ active hweight < 2 from donating. Excluding\nthese extreme low hweight donations shouldn't affect work conservation in\nany meaningful way.', 'bdu_cve_data_all': '', 'custom_cve_data_all': '', 'combined_cve_data_all': ''}
Component | Value | Weight | Comment |
---|---|---|---|
0 | 18 | Exploitation in the wild is NOT mentioned in available Data Sources | |
0 | 17 | The existence of publicly available or private exploit is NOT mentioned in available Data Sources | |
0 | 15 | Unknown Vulnerability Type | |
0.9 | 14 | The Linux kernel is a free and open-source, monolithic, modular, multitasking, Unix-like operating system kernel | |
0.0 | 10 | CVSS Base Score is NA. No data. | |
0.2 | 10 | EPSS Probability is 0.00045, EPSS Percentile is 0.16001 |
debian: CVE-2021-47584 was patched at 2024-06-30