VI
Product
Virtualization
On CISA KEVExploited in the wild
127
CVEs
5
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 14High 53Medium 44Low 1
Watch
Add Virtualization to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-2078 | 5.5 | Jun 30 | A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to trigger a buffer overflow via nft_set_desc_concat_parse() ,… Affected: 4.0 |
| CVE-2021-3620 | 5.5 | Mar 3 | A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error… Affected: 4.0 |
| CVE-2014-0148 | 5.5 | Feb 11 | Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for… Affected: 3.0 |
| CVE-2015-5160 | 5.5 | Aug 20 | libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a… Affected: 3.0 |
| CVE-2018-10862 | 5.5 | Jul 27 | WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files Affected: 4.0 |
| CVE-2017-5973 | 5.5 | Mar 27 | The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process… Affected: 4.0 |
| CVE-2016-5403 | 5.5 | Aug 2 | The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by… Affected: 3.0 |
| CVE-2018-1073 | 5.3 | Jun 19 | The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names… Affected: 4.0 |
| CVE-2016-8647 | 4.9 | Jul 26 | An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances Affected: 4.1 |
| CVE-2022-0207 | 4.7 | Aug 26 | A race condition was found in vdsm Affected: 4.0 |
| CVE-2016-6888 | 4.4 | Dec 10 | Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU… Affected: 4.0 |
| CVE-2019-14850 | 3.7 | Mar 18 | A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1 Affected: 4.0 |
| CVE-2015-3214 | – | Aug 31 | The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS… Affected: 3.0 |
| CVE-2015-5165 | – | Aug 12 | The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via… Affected: 3.0 |
| CVE-2015-3209 | – | Jun 15 | Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted… Affected: 3.0 |
| CVE-2015-0235 | – | Jan 28 | Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary… Affected: 6.0 |
| CVE-2014-7840 | – | Dec 12 | The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2)… Affected: 3.0 |
| CVE-2014-7815 | – | Nov 14 | The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value Affected: 3.0 |
| CVE-2014-3615 | – | Nov 1 | The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution Affected: 3.0 |
| CVE-2014-3469 | – | Jun 5 | The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference… Affected: 6.0 |
| CVE-2014-3468 | – | Jun 5 | The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to… Affected: 6.0 |
| CVE-2014-3467 | – | Jun 5 | Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via… Affected: 6.0 |
| CVE-2013-4344 | – | Oct 4 | Buffer overflow in the SCSI implementation in QEMU, as used in Xen, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small… Affected: 3.0 |
| CVE-2012-6075 | – | Feb 13 | Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote… Affected: 3.0 |
| CVE-2012-3515 | – | Nov 23 | Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a… Affected: 3.0; 5.0; 6.0 |
| CVE-2009-3080 | – | Nov 20 | Array index error in the gdth_read_event function in drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows local users to cause a denial of service or possibly gain… Affected: 5.0 |
| CVE-2009-2910 | – | Oct 20 | arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.31.4 on the x86_64 platform does not clear certain kernel registers before a return to user mode, which allows local users… Affected: 5 |