BA
Product
Bash
On CISA KEVExploited in the wild
18
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 8Medium 1Low 0
Watch
Add Bash to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-6278 In wildKEV | 8.8 | Sep 30 | GNU Bash OS Command Injection Vulnerability Affected: 1.14.0; 1.14.1; 1.14.2; 1.14.3; 1.14.4; 1.14.5; +22 more |
| CVE-2016-7543 | 8.4 | Jan 19 | Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables Affected: through 4.3 |
| CVE-2022-3715 | 7.8 | Jan 5 | A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform Affected: 5.1 before 5.1.8 |
| CVE-2019-18276 | 7.8 | Nov 28 | An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11 Affected: through 5.0; 5.0; 5.0; 5.0; 5.0; 5.0; +9 more |
| CVE-2012-6711 | 7.8 | Jun 18 | A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through… Affected: 4.2 through 4.3 |
| CVE-2019-9924 | 7.8 | Mar 22 | rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell Affected: before 4.4; 4.4 |
| CVE-2017-5932 | 7.8 | Mar 27 | The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution… Affected: 4.4 |
| CVE-2016-0634 | 7.5 | Aug 28 | The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine Affected: 4.3 |
Showing 8