EL
Product
Enterprise Linux Server Eus
On CISA KEVExploited in the wildRansomware-linked
620
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 150High 216Medium 134Low 0
Watch
Add Enterprise Linux Server Eus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9895 | 6.1 | Jun 11 | Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript Affected: 7.3; 7.4; 7.5 |
| CVE-2018-5950 | 6.1 | Jan 23 | Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL Affected: 7.4; 7.5; 7.6 |
| CVE-2018-2641 | 6.1 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT) Affected: 7.4; 7.5; 7.6 |
| CVE-2014-1530 | 6.1 | Apr 30 | The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the… Affected: 6.5 |
| CVE-2011-1776 | 6.1 | Sep 6 | The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT)… Affected: 5.6 |
| CVE-2018-5683 | 6.0 | Jan 23 | The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory… Affected: 7.6; 7.7 |
| CVE-2018-18506 | 5.9 | Feb 5 | When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to… Affected: 7.6 |
| CVE-2017-3143 | 5.9 | Jan 16 | An error in TSIG authentication can permit unauthorized dynamic updates Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-3136 | 5.9 | Jan 16 | An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;" Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-3135 | 5.9 | Jan 16 | Combination of DNS64 and RPZ Can Lead to Crash Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-8635 | 5.9 | Aug 1 | It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2018-10850 | 5.9 | Jun 13 | 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load Affected: 7.5; 7.6 |
| CVE-2018-5131 | 5.9 | Jun 11 | Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instead of downloading a… Affected: 7.4; 7.5 |
| CVE-2018-1049 | 5.9 | Feb 16 | In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel… Affected: 7.4; 7.5; 7.6 |
| CVE-2018-2618 | 5.9 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE) Affected: 7.4; 7.5; 7.6 |
| CVE-2015-7852 | 5.9 | Aug 7 | ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-2107 | 5.9 | May 5 | The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to… Affected: 7.2 |
| CVE-2016-0695 | 5.9 | Apr 21 | Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related… Affected: 6.7.z; 7.2 |
| CVE-2019-1125 | 5.6 | Sep 3 | An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory Affected: 7.7 |
| CVE-2018-3180 | 5.6 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JSSE) Affected: 7.5 |
| CVE-2016-0264 | 5.6 | May 24 | Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40… Affected: 6.7; 7.2; 7.3; 7.4; 7.5 |
| CVE-2021-3659 | 5.5 | Aug 22 | A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection Affected: 8.6 |
| CVE-2021-3744 | 5.5 | Mar 4 | A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory… Affected: 8.6 |
| CVE-2019-3838 | 5.5 | Mar 25 | It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27 Affected: 7.6 |
| CVE-2019-3835 | 5.5 | Mar 25 | It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27 Affected: 7.6 |
| CVE-2019-6454 | 5.5 | Mar 17 | An issue was discovered in sd-bus in systemd 239 Affected: 7.6 |
| CVE-2018-18397 | 5.5 | Dec 12 | The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data… Affected: 7.4; 7.5; 7.6 |
| CVE-2018-14646 | 5.5 | Nov 26 | The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file Affected: 7.5; 7.6 |
| CVE-2018-12383 | 5.5 | Oct 18 | If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible Affected: 7.5; 7.6 |
| CVE-2018-17972 | 5.5 | Oct 3 | An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11 Affected: 7.6 |
| CVE-2018-16542 | 5.5 | Sep 5 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking during error handling to crash the… Affected: 7.5 |
| CVE-2018-16541 | 5.5 | Sep 5 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the interpreter Affected: 7.6 |
| CVE-2018-16539 | 5.5 | Sep 5 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on… Affected: 7.6 |
| CVE-2015-5160 | 5.5 | Aug 20 | libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a… Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-2626 | 5.5 | Jul 27 | It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys Affected: 7.4; 7.5 |
| CVE-2017-2618 | 5.5 | Jul 27 | A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10 Affected: 7.3; 7.4; 7.5 |
| CVE-2017-2625 | 5.5 | Jul 27 | It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys Affected: 7.4; 7.5 |
| CVE-2017-18344 | 5.5 | Jul 26 | The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to… Affected: 7.3; 7.5 |
| CVE-2018-1000199 | 5.5 | May 24 | The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption Affected: 7.3; 7.4; 7.5 |
| CVE-2018-1106 | 5.5 | Apr 23 | An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages Affected: 7.5; 7.6 |
| CVE-2018-7858 | 5.5 | Mar 12 | Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and… Affected: 7.5; 7.6 |
| CVE-2016-9591 | 5.5 | Mar 9 | JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer Affected: 7.3; 7.4 |
| CVE-2018-5750 | 5.5 | Jan 26 | The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address information by reading dmesg data from an… Affected: 7.6 |
| CVE-2017-15121 | 5.5 | Dec 7 | A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary Affected: 7.6 |
| CVE-2017-3157 | 5.5 | Nov 20 | By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2015-3149 | 5.5 | Jul 25 | The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack Affected: 6.6z; 7.1 |
| CVE-2017-6011 | 5.5 | Feb 16 | An issue was discovered in icoutils 0.31.1 Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-6010 | 5.5 | Feb 16 | An issue was discovered in icoutils 0.31.1 Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-6009 | 5.5 | Feb 16 | An issue was discovered in icoutils 0.31.1 Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-5824 | 5.5 | Jan 27 | libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file Affected: 7.6 |
The 500 most important CVEs for this product (exploited first, then by severity)