PO
Product
Polkit
On CISA KEVExploited in the wildRansomware-linked
11
CVEs
2
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 3Low 0
Watch
Add Polkit to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-3560 In wildKEV | 7.8 | Feb 16 | Red Hat Polkit Incorrect Authorization Vulnerability Affected: before 0.119 |
| CVE-2021-4034 RansomwareIn wildKEV | 7.8 | Jan 28 | Red Hat Polkit Out-of-Bounds Read and Write Vulnerability Affected: before 121 |
| CVE-2018-19788 | 8.8 | Dec 3 | A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command Affected: 0.115 |
| CVE-2019-6133 | 6.7 | Jan 11 | In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached Affected: 0.115 |
| CVE-2021-4115 | 5.5 | Feb 21 | There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion Affected: 0.117 |
| CVE-2018-1116 | 4.4 | Jul 10 | A flaw was found in polkit before version 0.116 Affected: before 0.115 |
| CVE-2015-4625 | – | Oct 26 | Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of… Affected: through 0.112 |
| CVE-2015-3256 | – | Oct 26 | PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified… Affected: through 0.112 |
| CVE-2015-3255 | – | Oct 26 | The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via… Affected: through 0.112 |
| CVE-2015-3218 | – | Oct 26 | The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service… Affected: through 0.112 |
| CVE-2013-4288 | – | Oct 3 | Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the… Affected: before 0.112.1 |
Showing 11