EL
Product
Enterprise Linux Server Tus
On CISA KEVExploited in the wildRansomware-linked
765
CVEs
21
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 106High 264Medium 130Low 0
Watch
Add Enterprise Linux Server Tus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-9903 | 6.5 | Mar 21 | PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be… Affected: 8.2; 8.4; 8.6 |
| CVE-2018-18494 | 6.5 | Feb 28 | A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using… Affected: 7.6 |
| CVE-2018-12396 | 6.5 | Feb 28 | A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events Affected: 7.6 |
| CVE-2019-2455 | 6.5 | Jan 16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser) Affected: 8.2; 8.4; 8.6 |
| CVE-2019-2434 | 6.5 | Jan 16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser) Affected: 8.2; 8.4; 8.6 |
| CVE-2019-2529 | 6.5 | Jan 16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 8.2; 8.4; 8.6 |
| CVE-2019-2533 | 6.5 | Jan 16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Security : Privileges) Affected: 8.2; 8.4; 8.6 |
| CVE-2018-20662 | 6.5 | Jan 3 | In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from… Affected: 8.2; 8.4; 8.6 |
| CVE-2018-20650 | 6.5 | Jan 1 | A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use… Affected: 8.2; 8.4; 8.6 |
| CVE-2018-18897 | 6.5 | Nov 2 | An issue was discovered in Poppler 0.71.0 Affected: 8.2; 8.4; 8.6 |
| CVE-2016-2125 | 6.5 | Oct 31 | It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication Affected: 7.3; 7.6 |
| CVE-2018-12366 | 6.5 | Oct 18 | An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value Affected: 7.6 |
| CVE-2018-12365 | 6.5 | Oct 18 | A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction Affected: 7.6 |
| CVE-2018-5185 | 6.5 | Jun 11 | Plaintext of decrypted emails can leak through by user submitting an embedded form Affected: 7.6 |
| CVE-2018-2819 | 6.5 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB) Affected: 7.6; 7.7 |
| CVE-2018-2817 | 6.5 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 7.6; 7.7 |
| CVE-2016-9600 | 6.5 | Mar 12 | JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files Affected: 7.3; 7.6 |
| CVE-2014-8130 | 6.5 | Mar 12 | The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and… Affected: 7.2; 7.3 |
| CVE-2018-2668 | 6.5 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 7.6; 7.7 |
| CVE-2018-2665 | 6.5 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 7.6; 7.7 |
| CVE-2018-2640 | 6.5 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 7.6; 7.7 |
| CVE-2018-2622 | 6.5 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 7.6; 7.7 |
| CVE-2017-16541 | 6.5 | Nov 4 | Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web… Affected: 7.6; 7.7 |
| CVE-2017-10384 | 6.5 | Oct 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 7.6; 7.7 |
| CVE-2017-10379 | 6.5 | Oct 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs) Affected: 7.6; 7.7 |
| CVE-2017-10378 | 6.5 | Oct 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 7.6; 7.7 |
| CVE-2017-10243 | 6.5 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAX-WS) Affected: 7.3; 7.6; 7.7 |
| CVE-2015-7702 | 6.5 | Aug 7 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) Affected: 7.3; 7.6; 7.7 |
| CVE-2017-9775 | 6.5 | Jun 22 | Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document Affected: 7.4; 7.6 |
| CVE-2017-9461 | 6.5 | Jun 6 | smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly… Affected: 7.6 |
| CVE-2017-9287 | 6.5 | May 29 | servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability Affected: 7.6; 7.7 |
| CVE-2017-3453 | 6.5 | Apr 24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 7.6; 7.7 |
| CVE-2015-8896 | 6.5 | Mar 15 | Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file Affected: 7.2; 7.3; 7.6; 7.7 |
| CVE-2017-3258 | 6.5 | Jan 27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 7.6; 7.7 |
| CVE-2017-3244 | 6.5 | Jan 27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML) Affected: 7.6; 7.7 |
| CVE-2017-3238 | 6.5 | Jan 27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer) Affected: 7.6; 7.7 |
| CVE-2016-5626 | 6.5 | Oct 25 | Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors… Affected: 7.3; 7.6; 7.7 |
| CVE-2016-5624 | 6.5 | Oct 25 | Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows remote authenticated users to affect availability via vectors related to DML Affected: 7.3; 7.6; 7.7 |
| CVE-2016-5612 | 6.5 | Oct 25 | Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31 and earlier, and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors… Affected: 7.3; 7.6; 7.7 |
| CVE-2016-3492 | 6.5 | Oct 25 | Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors… Affected: 7.3; 7.6; 7.7 |
| CVE-2016-4020 | 6.5 | May 25 | The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information… Affected: 7.6; 7.7 |
| CVE-2015-8631 | 6.5 | Feb 13 | Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a… Affected: 7.2; 7.3; 7.6; 7.7 |
| CVE-2014-1523 | 6.5 | Apr 30 | Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote… Affected: 6.5 |
| CVE-2019-2503 | 6.4 | Jan 16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Connection Handling) Affected: 8.2; 8.4; 8.6 |
| CVE-2018-18073 | 6.3 | Oct 15 | Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object Affected: 7.6 |
| CVE-2017-3291 | 6.3 | Jan 27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging) Affected: 7.6; 7.7 |
| CVE-2014-0147 | 6.2 | Feb 11 | Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or… Affected: 6.5 |
| CVE-2017-10356 | 6.2 | Oct 19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: 7.4; 7.6; 7.7 |
| CVE-2019-17022 | 6.1 | Jan 8 | When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters Affected: 7.7 |
| CVE-2019-17016 | 6.1 | Jan 8 | When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule Affected: 7.7 |
The 500 most important CVEs for this product (exploited first, then by severity)