EL
Product
Enterprise Linux Server Tus
On CISA KEVExploited in the wildRansomware-linked
766
CVEs
21
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 107High 264Medium 129Low 0
Watch
Add Enterprise Linux Server Tus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1000805 | 8.8 | Oct 8 | Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE Affected: 6.6; 7.6 |
| CVE-2018-10873 | 8.8 | Aug 17 | A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks Affected: 7.6 |
| CVE-2018-5158 | 8.8 | Jun 11 | The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file Affected: 7.6 |
| CVE-2018-5146 | 8.8 | Jun 11 | An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest Affected: 7.4; 7.6 |
| CVE-2018-10392 | 8.8 | Apr 26 | mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer… Affected: 8.2; 8.4 |
| CVE-2014-8129 | 8.8 | Mar 12 | LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by… Affected: 7.2; 7.3 |
| CVE-2018-7550 | 8.8 | Mar 1 | The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value… Affected: 7.6; 7.7 |
| CVE-2018-6560 | 8.8 | Feb 2 | In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because… Affected: 7.6 |
| CVE-2017-17405 | 8.8 | Dec 15 | Ruby before 2.4.3 allows Net::FTP command injection Affected: 7.4; 7.6 |
| CVE-2017-5208 | 8.8 | Aug 22 | Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted executable, which… Affected: 7.3; 7.6 |
| CVE-2017-9462 | 8.8 | Jun 6 | In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a… Affected: 7.3; 7.6 |
| CVE-2016-7545 | 8.8 | Jan 19 | SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call Affected: 7.3 |
| CVE-2016-3710 | 8.8 | May 11 | The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by… Affected: 7.2; 7.3; 7.6; 7.7 |
| CVE-2014-1531 | 8.8 | Apr 30 | Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5,… Affected: 6.5 |
| CVE-2014-1529 | 8.8 | Apr 30 | The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass… Affected: 6.5 |
| CVE-2014-1518 | 8.8 | Apr 30 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow… Affected: 6.5 |
| CVE-2014-1513 | 8.8 | Mar 19 | TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition… Affected: 6.5 |
| CVE-2014-1509 | 8.8 | Mar 19 | Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and… Affected: 6.5 |
| CVE-2014-1497 | 8.8 | Mar 19 | The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote… Affected: 6.5 |
| CVE-2014-1482 | 8.8 | Feb 6 | RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which… Affected: 6.5 |
| CVE-2022-2601 | 8.6 | Dec 14 | A buffer overflow was found in grub_font_construct_glyph() Affected: 8.2 |
| CVE-2014-0144 | 8.6 | Sep 29 | QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused… Affected: 6.5 |
| CVE-2018-18284 | 8.6 | Oct 19 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator Affected: 7.6 |
| CVE-2018-17961 | 8.6 | Oct 15 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup Affected: 7.6 |
| CVE-2015-1779 | 8.6 | Jan 12 | The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers… Affected: 7.3; 7.6; 7.7 |
| CVE-2016-2857 | 8.4 | Apr 12 | The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length… Affected: 7.3; 7.6; 7.7 |
| CVE-2018-3169 | 8.3 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.6 |
| CVE-2018-3149 | 8.3 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI) Affected: 7.6 |
| CVE-2018-2814 | 8.3 | Apr 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.6 |
| CVE-2018-2633 | 8.3 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI) Affected: 7.4; 7.6 |
| CVE-2017-10116 | 8.3 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2017-10074 | 8.3 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2021-20233 | 8.2 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.4; 7.6; 7.7; 8.2 |
| CVE-2020-25632 | 8.2 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.4; 7.6; 7.7; 8.2 |
| CVE-2019-8308 | 8.2 | Feb 12 | Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file Affected: 7.6 |
| CVE-2018-11806 | 8.2 | Jun 13 | m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams Affected: 7.6; 7.7 |
| CVE-2020-25717 | 8.1 | Feb 18 | A flaw was found in the way Samba maps domain users to local users Affected: 8.4 |
| CVE-2020-2604 | 8.1 | Jan 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization) Affected: 7.7 |
| CVE-2018-1311 | 8.1 | Dec 18 | The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs Affected: 7.7 |
| CVE-2019-9506 | 8.1 | Aug 14 | The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length… Affected: 7.3; 7.4; 7.6; 7.7; 8.2; 8.4 |
| CVE-2019-13616 | 8.1 | Jul 16 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in… Affected: 7.7 |
| CVE-2019-2698 | 8.1 | Apr 23 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D) Affected: 8.2; 8.4; 8.6 |
| CVE-2019-3878 | 8.1 | Mar 26 | A vulnerability was found in mod_auth_mellon before v0.14.2 Affected: 7.6 |
| CVE-2019-6974 | 8.1 | Feb 15 | In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free Affected: 7.4; 7.6 |
| CVE-2018-18559 | 8.1 | Oct 22 | In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket Affected: 7.6 |
| CVE-2018-12386 | 8.1 | Oct 18 | A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write Affected: 7.6 |
| CVE-2018-5178 | 8.1 | Jun 11 | A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data Affected: 7.6 |
| CVE-2017-0902 | 8.1 | Aug 31 | RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a… Affected: 7.4; 7.6 |
| CVE-2017-10078 | 8.1 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting) Affected: 7.3; 7.6; 7.7 |
| CVE-2016-5387 | 8.1 | Jul 19 | The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY… Affected: 7.2; 7.3; 7.6; 7.7 |
The 500 most important CVEs for this product (exploited first, then by severity)