Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.5valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.EPSS 5.1%Feb 26, 2022
- High8.8In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.EPSS 4.1%Feb 24, 2022
- Critical10.0Debian-specific Redis Server Lua Sandbox Escape VulnerabilityKEVEPSS 99.4%Feb 18, 2022
- Critical9.8In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.EPSS 4.8%Feb 18, 2022
- High7.5In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.EPSS 4.7%Feb 18, 2022
- Medium6.5In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.EPSS 3.3%Feb 18, 2022
- High7.8Red Hat Polkit Incorrect Authorization VulnerabilityKEVEPSS 23.7%Feb 16, 2022
- Critical9.8xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.EPSS 34.2%Feb 16, 2022
- Critical9.8xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.EPSS 5.0%Feb 16, 2022
- High7.5Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.EPSS 4.0%Jan 26, 2022
- High7.0Linux Kernel Privilege Escalation VulnerabilityKEVEPSS 6.6%Jan 26, 2022
- Critical9.8Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.EPSS 4.6%Jan 24, 2022
- Critical9.8The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without…EPSS 4.3%Jan 14, 2022
- Critical9.8The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without v…EPSS 4.8%Jan 14, 2022
- Medium5.3Zabbix Frontend Improper Access Control VulnerabilityKEVEPSS 95.3%Jan 13, 2022
- High8.8storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 2.8%Jan 10, 2022
- High8.8nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 2.8%Jan 10, 2022
- High8.8lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 2.6%Jan 10, 2022
- Critical9.8defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 3.4%Jan 10, 2022
- Critical9.8build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 3.4%Jan 10, 2022
- Critical9.8addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.EPSS 4.8%Jan 10, 2022
- High8.8In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too…EPSS 4.2%Jan 1, 2022
- Medium6.4Android Kernel Race Condition VulnerabilityKEVEPSS 0.9%Dec 15, 2021
- Critical9.0Apache Log4j2 Deserialization of Untrusted Data VulnerabilityKEVEPSS 100.0%Dec 14, 2021
- Critical10.0Apache Log4j2 Remote Code Execution VulnerabilityKEVEPSS 100.0%Dec 10, 2021