EL
Product
Enterprise Linux Eus
On CISA KEVExploited in the wildRansomware-linked
789
CVEs
42
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 73High 196Medium 231Low 0
Watch
Add Enterprise Linux Eus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-46848 | 7.5 | Nov 3 | Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native… Affected: 9.2 |
| CVE-2023-46847 | 7.5 | Nov 3 | Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is… Affected: 8.6; 8.8; 9.0; 9.2 |
| CVE-2023-5157 | 7.5 | Sep 27 | A vulnerability was found in MariaDB Affected: 8.6; 8.8; 9.0; 9.2 |
| CVE-2023-38200 | 7.5 | Jul 24 | A flaw was found in Keylime Affected: 9.2 |
| CVE-2023-2295 | 7.5 | May 17 | A vulnerability was found in the libreswan library Affected: 8.8; 9.2 |
| CVE-2022-27649 | 7.5 | Apr 4 | A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions Affected: 8.4; 8.6 |
| CVE-2020-1045 | 7.5 | Sep 11 | <p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie… Affected: 8.2; 8.4; 8.6 |
| CVE-2020-9490 | 7.5 | Aug 7 | Apache HTTP Server versions 2.4.20 to 2.4.43 Affected: 8.1; 8.2; 8.4; 8.6 |
| CVE-2019-15604 | 7.5 | Feb 7 | Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate Affected: 8.1; 8.2; 8.4; 8.6 |
| CVE-2020-0602 | 7.5 | Jan 14 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability' Affected: 8.1 |
| CVE-2020-6851 | 7.5 | Jan 13 | OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation Affected: 7.7; 8.1; 8.2; 8.4 |
| CVE-2019-19906 | 7.5 | Dec 19 | cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet Affected: 8.4 |
| CVE-2019-6470 | 7.5 | Nov 1 | There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode Affected: 8.1; 8.2; 8.4; 8.6; 8.8 |
| CVE-2019-5010 | 7.5 | Oct 31 | An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6 Affected: 8.1; 8.2; 8.4; 8.6 |
| CVE-2019-16276 | 7.5 | Sep 30 | Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling Affected: 8.1 |
| CVE-2019-16884 | 7.5 | Sep 25 | runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount… Affected: 8.1; 8.2; 8.4 |
| CVE-2019-9514 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service Affected: 8.1 |
| CVE-2018-16871 | 7.5 | Jul 30 | A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20 Affected: 7.4 |
| CVE-2019-11478 | 7.5 | Jun 19 | Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective… Affected: 7.4; 7.5 |
| CVE-2019-11477 | 7.5 | Jun 19 | Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs) Affected: 7.4; 7.5 |
| CVE-2019-0820 | 7.5 | May 16 | A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability' Affected: 8.1; 8.2; 8.4; 8.6 |
| CVE-2019-2602 | 7.5 | Apr 23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 8.1; 8.2; 8.4; 8.6 |
| CVE-2019-3816 | 7.5 | Mar 14 | Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory Affected: 8.1; 8.2; 8.4 |
| CVE-2018-12121 | 7.5 | Nov 28 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized… Affected: 8.1; 8.2; 8.4; 8.6 |
| CVE-2018-10393 | 7.5 | Apr 26 | bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read Affected: 8.1; 8.2; 8.4 |
| CVE-2017-10388 | 7.5 | Oct 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-6796 | 7.5 | Aug 11 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured… Affected: 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-6797 | 7.5 | Aug 10 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web… Affected: 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-10115 | 7.5 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE) Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-10067 | 7.5 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security) Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-10664 | 7.5 | Aug 2 | qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client… Affected: 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-8743 | 7.5 | Jul 27 | Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-7668 | 7.5 | Jun 20 | The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input… Affected: 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-5848 | 7.5 | Feb 9 | The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and… Affected: 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-9446 | 7.5 | Jan 23 | The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1… Affected: 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-9131 | 7.5 | Jan 12 | named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon… Affected: 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-8864 | 7.5 | Nov 2 | named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon… Affected: 6.7; 7.2; 7.3; 7.4; 7.5; 7.6; +1 more |
| CVE-2016-3627 | 7.5 | May 17 | The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite… Affected: 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2015-3276 | 7.5 | Dec 7 | The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than… Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2014-1505 | 7.5 | Mar 19 | The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain… Affected: 6.5 |
| CVE-2014-1487 | 7.5 | Feb 6 | The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass… Affected: 6.5 |
| CVE-2014-1481 | 7.5 | Feb 6 | Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window… Affected: 6.5 |
| CVE-2014-1479 | 7.5 | Feb 6 | The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent… Affected: 6.5 |
| CVE-2012-0207 | 7.5 | May 17 | The igmp_heard_query function in net/ipv4/igmp.c in the Linux kernel before 3.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and panic) via IGMP… Affected: 5.6 |
| CVE-2010-0302 | 7.5 | Mar 5 | Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4,… Affected: 5.4 |
| CVE-2009-4272 | 7.5 | Jan 27 | A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via… Affected: 5.4 |
| CVE-2009-1837 | 7.5 | Jun 12 | Race condition in the NPObjWrapper_NewResolve function in modules/plugin/base/src/nsJSNPRuntime.cpp in xul.dll in Mozilla Firefox 3 before 3.0.11 might allow remote attackers to… Affected: 4.8; 5.3 |
| CVE-2006-5158 | 7.5 | Oct 5 | The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS… Affected: 4.5 |
| CVE-2025-3155 | 7.4 | Apr 3 | Yelp: arbitrary file read Affected: 9.2; 9.4; 9.6 |
| CVE-2019-14823 | 7.4 | Oct 14 | A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a… Affected: 7.7 |
The 500 most important CVEs for this product (exploited first, then by severity)