EL
Product
Enterprise Linux Server Tus
On CISA KEVExploited in the wildRansomware-linked
765
CVEs
21
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 106High 264Medium 130Low 0
Watch
Add Enterprise Linux Server Tus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-12121 | 7.5 | Nov 28 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized… Affected: 8.2; 8.4; 8.6 |
| CVE-2018-14638 | 7.5 | Sep 14 | A flaw was found in 389-ds-base before version 1.3.8.4-13 Affected: 7.6 |
| CVE-2018-5391 | 7.5 | Sep 6 | The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly Affected: 6.6; 7.2; 7.3; 7.4 |
| CVE-2018-14624 | 7.5 | Sep 6 | A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16 Affected: 7.6 |
| CVE-2018-5390 | 7.5 | Aug 6 | Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service Affected: 6.6; 7.2; 7.3; 7.4 |
| CVE-2018-5184 | 7.5 | Jun 11 | Using remote content in encrypted messages can lead to the disclosure of plaintext Affected: 7.6 |
| CVE-2018-5162 | 7.5 | Jun 11 | Plaintext of decrypted emails can leak through the src attribute of remote images, or links Affected: 7.6 |
| CVE-2018-5157 | 7.5 | Jun 11 | Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer Affected: 7.6 |
| CVE-2018-12020 | 7.5 | Jun 8 | mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on… Affected: 7.6 |
| CVE-2018-10393 | 7.5 | Apr 26 | bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read Affected: 8.2; 8.4 |
| CVE-2018-5748 | 7.5 | Jan 25 | qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply Affected: 7.6 |
| CVE-2017-1000410 | 7.5 | Dec 7 | The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages Affected: 7.4; 7.6 |
| CVE-2016-8610 | 7.5 | Nov 13 | A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection… Affected: 7.3; 7.6 |
| CVE-2017-10388 | 7.5 | Oct 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 7.4; 7.6; 7.7 |
| CVE-2017-1000115 | 7.5 | Oct 5 | Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository Affected: 7.4; 7.6 |
| CVE-2017-0901 | 7.5 | Aug 31 | RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem Affected: 7.4; 7.6 |
| CVE-2017-0900 | 7.5 | Aug 31 | RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query`… Affected: 7.4; 7.6 |
| CVE-2016-6796 | 7.5 | Aug 11 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured… Affected: 7.6; 7.7 |
| CVE-2016-6797 | 7.5 | Aug 10 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web… Affected: 7.6; 7.7 |
| CVE-2017-10115 | 7.5 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE) Affected: 7.3; 7.6; 7.7 |
| CVE-2017-10067 | 7.5 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security) Affected: 7.3; 7.6; 7.7 |
| CVE-2015-7704 | 7.5 | Aug 7 | The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages Affected: 6.5; 6.6; 7.3; 7.6; 7.7 |
| CVE-2015-7701 | 7.5 | Aug 7 | Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption) Affected: 7.3; 7.6; 7.7 |
| CVE-2015-7692 | 7.5 | Aug 7 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) Affected: 7.3; 7.6; 7.7 |
| CVE-2015-7691 | 7.5 | Aug 7 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing… Affected: 7.3; 7.6; 7.7 |
| CVE-2017-10664 | 7.5 | Aug 2 | qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client… Affected: 7.4; 7.6; 7.7 |
| CVE-2016-8743 | 7.5 | Jul 27 | Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers Affected: 7.3; 7.6; 7.7 |
| CVE-2015-7703 | 7.5 | Jul 24 | The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers… Affected: 7.3; 7.6; 7.7 |
| CVE-2017-10978 | 7.5 | Jul 17 | An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service Affected: 7.4; 7.6; 7.7 |
| CVE-2017-7668 | 7.5 | Jun 20 | The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input… Affected: 7.2; 7.3; 7.4; 7.6; 7.7 |
| CVE-2017-5848 | 7.5 | Feb 9 | The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and… Affected: 7.6; 7.7 |
| CVE-2016-9446 | 7.5 | Jan 23 | The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1… Affected: 7.6; 7.7 |
| CVE-2016-7426 | 7.5 | Jan 13 | NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial… Affected: 7.3; 7.6; 7.7 |
| CVE-2016-9131 | 7.5 | Jan 12 | named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon… Affected: 7.2; 7.3; 7.6; 7.7 |
| CVE-2016-8864 | 7.5 | Nov 2 | named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon… Affected: 6.5; 6.6; 7.2; 7.3; 7.6; 7.7 |
| CVE-2015-3276 | 7.5 | Dec 7 | The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than… Affected: 7.3; 7.6; 7.7 |
| CVE-2014-1505 | 7.5 | Mar 19 | The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain… Affected: 6.5 |
| CVE-2014-1487 | 7.5 | Feb 6 | The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass… Affected: 6.5 |
| CVE-2014-1481 | 7.5 | Feb 6 | Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window… Affected: 6.5 |
| CVE-2014-1479 | 7.5 | Feb 6 | The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent… Affected: 6.5 |
| CVE-2025-3155 | 7.4 | Apr 3 | A flaw was found in Yelp Affected: 8.4; 8.6; 8.8 |
| CVE-2019-14823 | 7.4 | Oct 14 | A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a… Affected: 7.7 |
| CVE-2019-0223 | 7.4 | Apr 23 | While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a… Affected: 7.2; 7.3; 7.4; 7.6 |
| CVE-2018-2637 | 7.4 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX) Affected: 7.4; 7.6 |
| CVE-2017-1000407 | 7.4 | Dec 11 | The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic Affected: 7.6 |
| CVE-2024-1488 | 7.3 | Feb 15 | A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration Affected: 8.2; 8.4; 8.6; 8.8 |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 7.7 |
| CVE-2020-25719 | 7.2 | Feb 18 | A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication Affected: 8.2; 8.4 |
| CVE-2019-10193 | 7.2 | Jul 11 | A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4 Affected: 8.2; 8.4 |
| CVE-2019-10192 | 7.2 | Jul 11 | A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4 Affected: 8.2; 8.4 |
The 500 most important CVEs for this product (exploited first, then by severity)