[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjuFmQy87UIVHC-XnD8cp7SmPVzR44hivcNtnIAtcSB0":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":271,"kevVulnerabilities":332,"topProductsByCves":656,"seoMetadata":667,"meta":676},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":270},4670,"canonical",57,4249,44,1842,"2025-10-02","c",[16,22,29,34,39,45,51,57,63,66,71,76,81,86,91,96,100,104,108,112,116,120,124,128,132,137,142,146,151,155,159,164,168,172,176,180,184,188,193,197,201,206,210,213,218,223,227,230,234,237,241,245,249,254,258,263,267],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},18948,"ubuntu_linux",76,4170,"2025-06-30",{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":27,"last_cve_update":28},18934,"snapd",275,16,0,"2024-07-25",{"id":30,"product_name":31,"version_count":32,"cve_count":26,"kev_count":27,"last_cve_update":33},18904,"apport",212,"2025-05-30",{"id":35,"product_name":36,"version_count":37,"cve_count":38,"kev_count":27,"last_cve_update":13},18919,"lxd",170,12,{"id":40,"product_name":41,"version_count":42,"cve_count":43,"kev_count":27,"last_cve_update":44},18910,"cloud-init",92,9,"2025-06-26",{"id":46,"product_name":47,"version_count":48,"cve_count":49,"kev_count":27,"last_cve_update":50},18911,"juju",201,6,"2024-10-02",{"id":52,"product_name":53,"version_count":54,"cve_count":55,"kev_count":27,"last_cve_update":56},18921,"metal_as_a_service",62,5,"2025-07-21",{"id":58,"product_name":59,"version_count":60,"cve_count":61,"kev_count":27,"last_cve_update":62},18944,"ubuntu_core",1,4,"2017-03-24",{"id":64,"product_name":65,"version_count":60,"cve_count":61,"kev_count":27,"last_cve_update":62},18951,"ubuntu_touch",{"id":67,"product_name":68,"version_count":69,"cve_count":61,"kev_count":27,"last_cve_update":70},18899,"accountsservice",11,"2025-03-25",{"id":72,"product_name":73,"version_count":43,"cve_count":74,"kev_count":27,"last_cve_update":75},18914,"landscape",3,"2023-06-06",{"id":77,"product_name":78,"version_count":79,"cve_count":74,"kev_count":27,"last_cve_update":80},18923,"multipass",35,"2025-07-12",{"id":82,"product_name":83,"version_count":84,"cve_count":74,"kev_count":27,"last_cve_update":85},18937,"subiquity",81,"2024-06-03",{"id":87,"product_name":88,"version_count":89,"cve_count":74,"kev_count":27,"last_cve_update":90},18906,"authd",13,"2025-06-16",{"id":92,"product_name":93,"version_count":60,"cve_count":94,"kev_count":27,"last_cve_update":95},18941,"ubuntu",2,"2015-01-16",{"id":97,"product_name":98,"version_count":74,"cve_count":94,"kev_count":27,"last_cve_update":99},18900,"acpi-support","2014-09-22",{"id":101,"product_name":102,"version_count":60,"cve_count":94,"kev_count":27,"last_cve_update":103},18918,"lxcfs","2015-12-07",{"id":105,"product_name":106,"version_count":54,"cve_count":94,"kev_count":27,"last_cve_update":107},18920,"maas","2013-11-23",{"id":109,"product_name":110,"version_count":74,"cve_count":94,"kev_count":27,"last_cve_update":111},18935,"software-properties","2020-12-02",{"id":113,"product_name":114,"version_count":60,"cve_count":94,"kev_count":27,"last_cve_update":115},18953,"unity-firefox-extension","2021-04-07",{"id":117,"product_name":118,"version_count":27,"cve_count":94,"kev_count":27,"last_cve_update":119},18954,"update-manager","2014-04-27",{"id":121,"product_name":122,"version_count":94,"cve_count":60,"kev_count":27,"last_cve_update":123},18952,"ubuntu-ui-toolkit","2020-09-11",{"id":125,"product_name":126,"version_count":27,"cve_count":60,"kev_count":27,"last_cve_update":127},18916,"linux-bluefield","2025-03-31",{"id":129,"product_name":130,"version_count":61,"cve_count":60,"kev_count":27,"last_cve_update":131},18917,"ltsp_display_manager","2014-05-21",{"id":133,"product_name":134,"version_count":135,"cve_count":60,"kev_count":27,"last_cve_update":136},18901,"add-apt-repository",8,"2020-09-05",{"id":138,"product_name":139,"version_count":140,"cve_count":60,"kev_count":27,"last_cve_update":141},18922,"microk8s",10,"2020-04-08",{"id":143,"product_name":144,"version_count":60,"cve_count":60,"kev_count":27,"last_cve_update":145},18909,"c-kernel","2020-04-14",{"id":147,"product_name":148,"version_count":149,"cve_count":60,"kev_count":27,"last_cve_update":150},18924,"netplan",94,"2024-06-07",{"id":152,"product_name":153,"version_count":74,"cve_count":60,"kev_count":27,"last_cve_update":154},18925,"openstack_ironic","2016-07-12",{"id":156,"product_name":157,"version_count":61,"cve_count":60,"kev_count":27,"last_cve_update":158},18927,"php5","2012-08-07",{"id":160,"product_name":161,"version_count":162,"cve_count":60,"kev_count":27,"last_cve_update":163},18928,"ppp",63,"2020-09-01",{"id":165,"product_name":166,"version_count":60,"cve_count":60,"kev_count":27,"last_cve_update":167},18929,"remote-login-service","2021-01-13",{"id":169,"product_name":170,"version_count":60,"cve_count":60,"kev_count":27,"last_cve_update":171},18930,"reportbug","2014-08-06",{"id":173,"product_name":174,"version_count":60,"cve_count":60,"kev_count":27,"last_cve_update":175},18931,"screen-resolution-extra","2018-03-28",{"id":177,"product_name":178,"version_count":27,"cve_count":60,"kev_count":27,"last_cve_update":179},18932,"selinux","2019-04-22",{"id":181,"product_name":182,"version_count":60,"cve_count":60,"kev_count":27,"last_cve_update":183},18933,"snapcraft","2020-12-04",{"id":185,"product_name":186,"version_count":60,"cve_count":60,"kev_count":27,"last_cve_update":187},18908,"checkinstall","2020-08-31",{"id":189,"product_name":190,"version_count":191,"cve_count":60,"kev_count":27,"last_cve_update":192},18955,"whoopsie",117,"2020-08-06",{"id":194,"product_name":195,"version_count":27,"cve_count":60,"kev_count":27,"last_cve_update":196},18936,"spread","2006-06-30",{"id":198,"product_name":199,"version_count":60,"cve_count":60,"kev_count":27,"last_cve_update":200},18907,"bazaar","2017-11-27",{"id":202,"product_name":203,"version_count":204,"cve_count":60,"kev_count":27,"last_cve_update":205},18938,"telepathy-idle",7,"2013-05-21",{"id":207,"product_name":208,"version_count":60,"cve_count":60,"kev_count":27,"last_cve_update":209},18939,"trust-store_\\(ubuntu\\)","2020-07-22",{"id":211,"product_name":212,"version_count":60,"cve_count":60,"kev_count":27,"last_cve_update":209},18940,"trust-store_\\(ubuntu_rtm\\)",{"id":214,"product_name":215,"version_count":216,"cve_count":60,"kev_count":27,"last_cve_update":217},18905,"apt-xapian-index",68,"2013-10-03",{"id":219,"product_name":220,"version_count":221,"cve_count":60,"kev_count":27,"last_cve_update":222},18942,"ubuntu_advantage_desktop_daemon",14,"2024-06-27",{"id":224,"product_name":225,"version_count":60,"cve_count":60,"kev_count":27,"last_cve_update":226},18943,"ubuntu_cobbler","2019-12-06",{"id":228,"product_name":229,"version_count":69,"cve_count":60,"kev_count":27,"last_cve_update":179},18903,"apparmor",{"id":231,"product_name":232,"version_count":60,"cve_count":60,"kev_count":27,"last_cve_update":233},18945,"ubuntu-core-launcher","2016-05-13",{"id":235,"product_name":236,"version_count":27,"cve_count":60,"kev_count":27,"last_cve_update":179},18946,"ubuntu_download_manager",{"id":238,"product_name":239,"version_count":60,"cve_count":60,"kev_count":27,"last_cve_update":240},18947,"ubuntu-image","2017-07-11",{"id":242,"product_name":243,"version_count":204,"cve_count":60,"kev_count":27,"last_cve_update":244},18902,"anbox_cloud","2024-09-18",{"id":246,"product_name":247,"version_count":27,"cve_count":60,"kev_count":27,"last_cve_update":248},18949,"ubuntu_pipewire-pulse","2024-01-24",{"id":250,"product_name":251,"version_count":252,"cve_count":60,"kev_count":27,"last_cve_update":253},18950,"ubuntu_software_properties",52,"2012-10-10",{"id":255,"product_name":256,"version_count":61,"cve_count":60,"kev_count":27,"last_cve_update":257},18915,"libpam-modules","2014-04-15",{"id":259,"product_name":260,"version_count":261,"cve_count":27,"kev_count":27,"last_cve_update":262},18912,"juju\\\u002Futils",15,null,{"id":264,"product_name":265,"version_count":266,"cve_count":27,"kev_count":27,"last_cve_update":262},18926,"pebble",37,{"id":268,"product_name":269,"version_count":27,"cve_count":27,"kev_count":27,"last_cve_update":262},18913,"juju\\\\\u002Futils","Canonical is a technology vendor with 57 tracked products and 4249 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[272,280,286,291,299,304,309,315,320,327],{"cveId":273,"description":274,"publishedDate":275,"cvssScore":276,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":279},"CVE-2014-0160","The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.","2014-04-07",7.5,"v3.1","High",0.99999,{"cveId":281,"description":282,"publishedDate":283,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":279},"CVE-2014-6271","GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka \"ShellShock.\"  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.","2014-09-24",9.8,"Critical",{"cveId":287,"description":288,"publishedDate":289,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":290},"CVE-2014-7169","GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.","2014-09-25",0.9994,{"cveId":292,"description":293,"publishedDate":294,"cvssScore":295,"cvssVersion":296,"severity":278,"isKev":297,"epssScore":298},"CVE-2011-3192","The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.","2011-08-29",7.8,"v2",false,0.98945,{"cveId":300,"description":301,"publishedDate":302,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":303},"CVE-2013-0422","Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114.  CVE-2013-0422 covers both the JMX\u002FMBean and Reflection API issues.  NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks.  NOTE: as of 20130114, a reliable third party has claimed that the findClass\u002FMBeanInstantiator vector was not fixed in Oracle Java 7 Update 11.  If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.","2013-01-10",0.97612,{"cveId":305,"description":306,"publishedDate":307,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":308},"CVE-2011-3544","Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.","2011-10-19",0.96714,{"cveId":310,"description":311,"publishedDate":312,"cvssScore":313,"cvssVersion":296,"severity":278,"isKev":297,"epssScore":314},"CVE-2006-3747","Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.","2006-07-28",7.6,0.96436,{"cveId":316,"description":317,"publishedDate":318,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":319},"CVE-2010-0840","Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) \"a similar trust issue with interfaces,\" aka \"Trusted Methods Chaining Remote Code Execution Vulnerability.\"","2010-04-01",0.96319,{"cveId":321,"description":322,"publishedDate":323,"cvssScore":324,"cvssVersion":277,"severity":325,"isKev":297,"epssScore":326},"CVE-2008-1447","The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and other implementations allow remote attackers to spoof DNS traffic via a birthday attack that uses in-bailiwick referrals to conduct cache poisoning against recursive resolvers, related to insufficient randomness of DNS transaction IDs and source ports, aka \"DNS Insufficient Socket Entropy Vulnerability\" or \"the Kaminsky bug.\"","2008-07-08",6.8,"Medium",0.95182,{"cveId":328,"description":329,"publishedDate":312,"cvssScore":330,"cvssVersion":296,"severity":325,"isKev":297,"epssScore":331},"CVE-2006-3918","http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.",4.3,0.94281,[333,342,351,360,368,378,388,396,405,412,420,427,435,444,452,460,464,467,474,480,488,492,500,507,515,522,530,537,543,550,557,560,566,574,577,579,587,595,603,610,617,624,631,637,644,650],{"cveId":334,"description":335,"publishedDate":336,"cvssScore":295,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":337,"cisaVulnName":338,"cisaDateAdded":339,"cisaShortDescription":340,"cisaRequiredAction":341},"CVE-2022-0492","A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel\u002Fcgroup\u002Fcgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.","2022-03-03",0.05528,"Linux Kernel Improper Authentication Vulnerability","2026-06-02","Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":343,"description":344,"publishedDate":345,"cvssScore":295,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":346,"cisaVulnName":347,"cisaDateAdded":348,"cisaShortDescription":349,"cisaRequiredAction":350},"CVE-2026-31431","In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings.  Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.","2026-04-22",0.96267,"Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability","2026-05-01","Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.","\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":352,"description":353,"publishedDate":354,"cvssScore":295,"cvssVersion":355,"severity":278,"isKev":4,"epssScore":356,"cisaVulnName":357,"cisaDateAdded":358,"cisaShortDescription":359,"cisaRequiredAction":341},"CVE-2018-14634","An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.","2018-09-25","v3.0",0.14806,"Linux Kernel Integer Overflow Vulnerability","2026-01-26","Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.",{"cveId":361,"description":362,"publishedDate":21,"cvssScore":363,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":364,"cisaVulnName":365,"cisaDateAdded":366,"cisaShortDescription":367,"cisaRequiredAction":341},"CVE-2025-32463","Sudo before 1.9.17p1 allows local users to obtain root access because \u002Fetc\u002Fnsswitch.conf from a user-controlled directory is used with the --chroot option.",9.3,0.47467,"Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability","2025-09-29","Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file.",{"cveId":369,"description":370,"publishedDate":371,"cvssScore":372,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":373,"cisaVulnName":374,"cisaDateAdded":375,"cisaShortDescription":376,"cisaRequiredAction":377},"CVE-2016-3714","The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka \"ImageTragick.\"","2016-05-05",8.4,0.97485,"ImageMagick Improper Input Validation Vulnerability","2024-09-09","ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":379,"description":380,"publishedDate":381,"cvssScore":382,"cvssVersion":277,"severity":325,"isKev":4,"epssScore":383,"cisaVulnName":384,"cisaDateAdded":385,"cisaShortDescription":386,"cisaRequiredAction":387},"CVE-2022-2586","It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.","2024-01-08",5.3,0.12746,"Linux Kernel Use-After-Free Vulnerability","2024-06-26","Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges. ","Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.",{"cveId":389,"description":390,"publishedDate":391,"cvssScore":295,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":392,"cisaVulnName":393,"cisaDateAdded":394,"cisaShortDescription":395,"cisaRequiredAction":377},"CVE-2023-4911","A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.","2023-10-03",0.81422,"GNU C Library Buffer Overflow Vulnerability","2023-11-21","GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.",{"cveId":397,"description":398,"publishedDate":399,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":400,"cisaVulnName":401,"cisaDateAdded":402,"cisaShortDescription":403,"cisaRequiredAction":404},"CVE-2016-8735","Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","2017-04-06",0.90338,"Apache Tomcat Remote Code Execution Vulnerability","2023-05-12","Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.","Apply updates per vendor instructions.",{"cveId":406,"description":407,"publishedDate":408,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":409,"cisaVulnName":410,"cisaDateAdded":402,"cisaShortDescription":411,"cisaRequiredAction":404},"CVE-2016-3427","Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.","2016-04-21",0.92334,"Oracle Java SE and JRockit Unspecified Vulnerability","Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.",{"cveId":413,"description":414,"publishedDate":415,"cvssScore":295,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":416,"cisaVulnName":417,"cisaDateAdded":402,"cisaShortDescription":418,"cisaRequiredAction":419},"CVE-2010-3904","The rds_page_copy_user function in net\u002Frds\u002Fpage.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.","2010-12-06",0.11217,"Linux Kernel Improper Input Validation Vulnerability","Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.","The impacted product is end-of-life and should be disconnected if still in use.",{"cveId":421,"description":422,"publishedDate":423,"cvssScore":295,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":424,"cisaVulnName":425,"cisaDateAdded":402,"cisaShortDescription":426,"cisaRequiredAction":404},"CVE-2021-3560","It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.","2022-02-16",0.22193,"Red Hat Polkit Incorrect Authorization Vulnerability","Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.",{"cveId":428,"description":429,"publishedDate":430,"cvssScore":431,"cvssVersion":277,"severity":325,"isKev":4,"epssScore":432,"cisaVulnName":433,"cisaDateAdded":402,"cisaShortDescription":434,"cisaRequiredAction":419},"CVE-2014-0196","The n_tty_write function in drivers\u002Ftty\u002Fn_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the \"LECHO & !OPOST\" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.","2014-05-07",5.5,0.22475,"Linux Kernel Race Condition Vulnerability","Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.",{"cveId":436,"description":437,"publishedDate":438,"cvssScore":439,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":440,"cisaVulnName":441,"cisaDateAdded":442,"cisaShortDescription":443,"cisaRequiredAction":404},"CVE-2021-3493","The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.","2021-04-17",8.8,0.43988,"Linux Kernel Privilege Escalation Vulnerability","2022-10-20","The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.",{"cveId":445,"description":446,"publishedDate":447,"cvssScore":295,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":448,"cisaVulnName":449,"cisaDateAdded":450,"cisaShortDescription":451,"cisaRequiredAction":404},"CVE-2021-4034","A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.","2022-01-28",0.94921,"Red Hat Polkit Out-of-Bounds Read and Write Vulnerability","2022-06-27","The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.",{"cveId":453,"description":454,"publishedDate":455,"cvssScore":439,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":456,"cisaVulnName":457,"cisaDateAdded":458,"cisaShortDescription":459,"cisaRequiredAction":404},"CVE-2016-1646","The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.","2016-03-29",0.4811,"Google Chromium V8 Out-of-Bounds Read Vulnerability","2022-06-08","Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.",{"cveId":300,"description":301,"publishedDate":302,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":303,"cisaVulnName":461,"cisaDateAdded":462,"cisaShortDescription":463,"cisaRequiredAction":404},"Oracle JRE Remote Code Execution Vulnerability","2022-05-25","A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.",{"cveId":316,"description":317,"publishedDate":318,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":319,"cisaVulnName":465,"cisaDateAdded":462,"cisaShortDescription":466,"cisaRequiredAction":404},"Oracle JRE Unspecified Vulnerability","Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.",{"cveId":468,"description":469,"publishedDate":470,"cvssScore":439,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":471,"cisaVulnName":472,"cisaDateAdded":462,"cisaShortDescription":473,"cisaRequiredAction":404},"CVE-2015-4495","The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.","2015-08-08",0.70226,"Mozilla Firefox Security Feature Bypass Vulnerability","Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.",{"cveId":475,"description":476,"publishedDate":477,"cvssScore":295,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":478,"cisaVulnName":441,"cisaDateAdded":462,"cisaShortDescription":479,"cisaRequiredAction":404},"CVE-2014-3153","The futex_requeue function in kernel\u002Ffutex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.","2014-06-07",0.37233,"The futex_requeue function in kernel\u002Ffutex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.",{"cveId":481,"description":482,"publishedDate":483,"cvssScore":484,"cvssVersion":277,"severity":485,"isKev":4,"epssScore":486,"cisaVulnName":465,"cisaDateAdded":462,"cisaShortDescription":487,"cisaRequiredAction":404},"CVE-2013-2423","Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.","2013-04-17",3.7,"Low",0.85333,"Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.",{"cveId":273,"description":274,"publishedDate":275,"cvssScore":276,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":279,"cisaVulnName":489,"cisaDateAdded":490,"cisaShortDescription":491,"cisaRequiredAction":404},"OpenSSL Information Disclosure Vulnerability","2022-05-04","The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.",{"cveId":493,"description":494,"publishedDate":495,"cvssScore":140,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":496,"cisaVulnName":497,"cisaDateAdded":498,"cisaShortDescription":499,"cisaRequiredAction":404},"CVE-2022-0543","It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.","2022-02-18",0.9967,"Debian-specific Redis Server Lua Sandbox Escape Vulnerability","2022-03-28","Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.",{"cveId":501,"description":502,"publishedDate":503,"cvssScore":439,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":504,"cisaVulnName":505,"cisaDateAdded":498,"cisaShortDescription":506,"cisaRequiredAction":404},"CVE-2013-1690","Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.","2013-06-26",0.69021,"Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability","Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.",{"cveId":508,"description":509,"publishedDate":510,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":511,"cisaVulnName":512,"cisaDateAdded":513,"cisaShortDescription":514,"cisaRequiredAction":404},"CVE-2010-4344","Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.","2010-12-14",0.71794,"Exim Heap-Based Buffer Overflow Vulnerability","2022-03-25","Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.",{"cveId":516,"description":517,"publishedDate":518,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":519,"cisaVulnName":520,"cisaDateAdded":513,"cisaShortDescription":521,"cisaRequiredAction":404},"CVE-2020-7247","smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the \"uncommented\" default configuration. The issue exists because of an incorrect return value upon failure of input validation.","2020-01-29",0.98946,"OpenSMTPD Remote Code Execution Vulnerability","smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.",{"cveId":523,"description":524,"publishedDate":525,"cvssScore":526,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":527,"cisaVulnName":528,"cisaDateAdded":513,"cisaShortDescription":529,"cisaRequiredAction":404},"CVE-2019-11043","In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.","2019-10-28",8.7,0.9947,"PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability","In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.",{"cveId":531,"description":532,"publishedDate":533,"cvssScore":534,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":535,"cisaVulnName":401,"cisaDateAdded":513,"cisaShortDescription":536,"cisaRequiredAction":404},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,0.99988,"When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":538,"description":539,"publishedDate":510,"cvssScore":295,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":540,"cisaVulnName":541,"cisaDateAdded":513,"cisaShortDescription":542,"cisaRequiredAction":404},"CVE-2010-4345","Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.",0.17794,"Exim Privilege Escalation Vulnerability","Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.",{"cveId":544,"description":545,"publishedDate":546,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":547,"cisaVulnName":548,"cisaDateAdded":336,"cisaShortDescription":549,"cisaRequiredAction":404},"CVE-2015-2590","Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.","2015-07-16",0.25469,"Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability","An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.",{"cveId":551,"description":552,"publishedDate":553,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":554,"cisaVulnName":555,"cisaDateAdded":336,"cisaShortDescription":556,"cisaRequiredAction":404},"CVE-2019-16928","Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.","2019-09-27",0.41589,"Exim Out-of-bounds Write Vulnerability","Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.",{"cveId":305,"description":306,"publishedDate":307,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":308,"cisaVulnName":558,"cisaDateAdded":336,"cisaShortDescription":559,"cisaRequiredAction":404},"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.",{"cveId":561,"description":562,"publishedDate":563,"cvssScore":204,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":564,"cisaVulnName":433,"cisaDateAdded":336,"cisaShortDescription":565,"cisaRequiredAction":404},"CVE-2016-5195","Race condition in mm\u002Fgup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka \"Dirty COW.\"","2016-11-10",0.83524,"Race condition in mm\u002Fgup.c in the Linux kernel allows local users to escalate privileges.",{"cveId":567,"description":568,"publishedDate":569,"cvssScore":570,"cvssVersion":277,"severity":325,"isKev":4,"epssScore":571,"cisaVulnName":572,"cisaDateAdded":336,"cisaShortDescription":573,"cisaRequiredAction":404},"CVE-2013-1675","Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.","2013-05-16",6.5,0.06696,"Mozilla Firefox Information Disclosure Vulnerability","Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.",{"cveId":287,"description":288,"publishedDate":289,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":290,"cisaVulnName":575,"cisaDateAdded":447,"cisaShortDescription":576,"cisaRequiredAction":404},"GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability","GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.",{"cveId":281,"description":282,"publishedDate":283,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":279,"cisaVulnName":575,"cisaDateAdded":447,"cisaShortDescription":578,"cisaRequiredAction":404},"GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.",{"cveId":580,"description":581,"publishedDate":582,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":583,"cisaVulnName":584,"cisaDateAdded":585,"cisaShortDescription":586,"cisaRequiredAction":404},"CVE-2019-10149","A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in \u002Fsrc\u002Fdeliver.c may lead to remote command execution.","2019-06-05",0.99961,"Exim Mail Transfer Agent (MTA) Improper Input Validation","2022-01-10","Improper validation of recipient address in deliver_message() function in \u002Fsrc\u002Fdeliver.c may lead to remote command execution.",{"cveId":588,"description":589,"publishedDate":590,"cvssScore":295,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":591,"cisaVulnName":592,"cisaDateAdded":593,"cisaShortDescription":594,"cisaRequiredAction":404},"CVE-2019-13272","In the Linux kernel before 5.1.17, ptrace_link in kernel\u002Fptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.","2019-07-17",0.52199,"Linux Kernel Improper Privilege Management Vulnerability","2021-12-10","Kernel\u002Fptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.",{"cveId":596,"description":597,"publishedDate":598,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":599,"cisaVulnName":600,"cisaDateAdded":601,"cisaShortDescription":602,"cisaRequiredAction":404},"CVE-2018-6789","An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.","2018-02-08",0.82238,"Exim Buffer Overflow Vulnerability","2021-11-03","Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.",{"cveId":604,"description":605,"publishedDate":606,"cvssScore":284,"cvssVersion":277,"severity":285,"isKev":4,"epssScore":607,"cisaVulnName":608,"cisaDateAdded":601,"cisaShortDescription":609,"cisaRequiredAction":404},"CVE-2020-11651","An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and\u002For run arbitrary commands on salt minions.","2020-04-30",0.96405,"SaltStack Salt Authentication Bypass Vulnerability","SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and\u002For run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.",{"cveId":611,"description":612,"publishedDate":613,"cvssScore":439,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":614,"cisaVulnName":615,"cisaDateAdded":601,"cisaShortDescription":616,"cisaRequiredAction":404},"CVE-2019-17026","Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR \u003C 68.4.1, Thunderbird \u003C 68.4.1, and Firefox \u003C 72.0.1.","2020-03-02",0.46589,"Mozilla Firefox And Thunderbird Type Confusion Vulnerability","Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.",{"cveId":618,"description":619,"publishedDate":620,"cvssScore":295,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":621,"cisaVulnName":622,"cisaDateAdded":601,"cisaShortDescription":623,"cisaRequiredAction":404},"CVE-2019-2215","A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095","2019-10-11",0.72105,"Android Kernel Use-After-Free Vulnerability","Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain \"AbstractEmu.\"",{"cveId":625,"description":626,"publishedDate":627,"cvssScore":295,"cvssVersion":277,"severity":278,"isKev":4,"epssScore":628,"cisaVulnName":629,"cisaDateAdded":601,"cisaShortDescription":630,"cisaRequiredAction":404},"CVE-2019-0211","In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.","2019-04-08",0.65005,"Apache HTTP Server Privilege Escalation Vulnerability","Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.",{"cveId":632,"description":633,"publishedDate":606,"cvssScore":570,"cvssVersion":277,"severity":325,"isKev":4,"epssScore":634,"cisaVulnName":635,"cisaDateAdded":601,"cisaShortDescription":636,"cisaRequiredAction":404},"CVE-2020-11652","An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.",0.86063,"SaltStack Salt Path Traversal Vulnerability","SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability.",{"cveId":638,"description":639,"publishedDate":640,"cvssScore":431,"cvssVersion":277,"severity":325,"isKev":4,"epssScore":641,"cisaVulnName":642,"cisaDateAdded":601,"cisaShortDescription":643,"cisaRequiredAction":404},"CVE-2020-1472","An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.\nTo exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.\nMicrosoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels.\nFor guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see  How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020).\nWhen the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.\n","2020-08-17",0.99512,"Microsoft Netlogon Privilege Escalation Vulnerability","Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.",{"cveId":645,"description":646,"publishedDate":371,"cvssScore":431,"cvssVersion":277,"severity":325,"isKev":4,"epssScore":647,"cisaVulnName":648,"cisaDateAdded":601,"cisaShortDescription":649,"cisaRequiredAction":404},"CVE-2016-3715","The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.",0.75383,"ImageMagick Arbitrary File Deletion Vulnerability","ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.",{"cveId":651,"description":652,"publishedDate":371,"cvssScore":431,"cvssVersion":277,"severity":325,"isKev":4,"epssScore":653,"cisaVulnName":654,"cisaDateAdded":601,"cisaShortDescription":655,"cisaRequiredAction":404},"CVE-2016-3718","The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.",0.76897,"ImageMagick Server-Side Request Forgery (SSRF) Vulnerability","ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.",[657,658,659,660,661,662,663,664,665,666],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":27,"last_cve_update":28},{"id":30,"product_name":31,"version_count":32,"cve_count":26,"kev_count":27,"last_cve_update":33},{"id":35,"product_name":36,"version_count":37,"cve_count":38,"kev_count":27,"last_cve_update":13},{"id":40,"product_name":41,"version_count":42,"cve_count":43,"kev_count":27,"last_cve_update":44},{"id":46,"product_name":47,"version_count":48,"cve_count":49,"kev_count":27,"last_cve_update":50},{"id":52,"product_name":53,"version_count":54,"cve_count":55,"kev_count":27,"last_cve_update":56},{"id":58,"product_name":59,"version_count":60,"cve_count":61,"kev_count":27,"last_cve_update":62},{"id":64,"product_name":65,"version_count":60,"cve_count":61,"kev_count":27,"last_cve_update":62},{"id":67,"product_name":68,"version_count":69,"cve_count":61,"kev_count":27,"last_cve_update":70},{"title":668,"metaDescription":669,"keywords":670,"structuredData":671},"Canonical - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Canonical covering 57 products with 4249 tracked vulnerabilities including 16 critical and 22 high-severity issues and 44 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Canonical vulnerabilities, Canonical security, Canonical CVE, Canonical threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Canonical KEV, Canonical exploited vulnerabilities",{"@context":672,"@type":673,"name":674,"description":669,"url":675},"https:\u002F\u002Fschema.org","Organization","Canonical","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fcanonical",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":677,"apiVersion":678},"2026-10-28T16:20:46.959Z","3.0"]