XE
Product
Xen
490
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 16High 134Medium 162Low 11
Watch
Add Xen to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-28696 | 6.8 | Aug 27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and… Affected: All versions, or not specified |
| CVE-2021-28695 | 6.8 | Aug 27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and… Affected: All versions, or not specified |
| CVE-2021-28694 | 6.8 | Aug 27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Both AMD and… Affected: All versions, or not specified |
| CVE-2019-19579 | 6.8 | Dec 4 | An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device (and… Affected: through 4.12.1 |
| CVE-2019-18424 | 6.8 | Oct 31 | An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device Affected: through 4.12.1 |
| CVE-2019-17343 | 6.8 | Oct 8 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging incorrect use of the HVM physmap concept… Affected: through 4.11.2 |
| CVE-2016-2270 | 6.8 | Feb 19 | Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different… Affected: through 4.6.1 |
| CVE-2023-4949 | 6.7 | Nov 10 | An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory… Affected: All versions, or not specified |
| CVE-2022-26364 | 6.7 | Jun 9 | x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… Affected: All versions, or not specified |
| CVE-2022-26363 | 6.7 | Jun 9 | x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… Affected: All versions, or not specified |
| CVE-2016-7154 | 6.7 | Sep 21 | Use-after-free vulnerability in the FIFO event channel code in Xen 4.4.x allows local guest OS administrators to cause a denial of service (host crash) and possibly execute… Affected: 4.4.0; 4.4.1; 4.4.2; 4.4.3; 4.4.4 |
| CVE-2016-4962 | 6.7 | Jun 7 | The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or… Affected: 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; 4.4.0; +11 more |
| CVE-2019-19580 | 6.6 | Dec 11 | An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion… Affected: through 4.12.1 |
| CVE-2026-23557 | 6.5 | May 19 | Xenstored DoS via XS_RESET_WATCHES command Affected: 4.2.0 and later |
| CVE-2024-45818 | 6.5 | Dec 19 | Deadlock in x86 HVM standard VGA handling Affected: 4.6.0 before 4.20.0 |
| CVE-2023-46842 | 6.5 | May 16 | Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes Affected: 3.2.0 and later |
| CVE-2023-46841 | 6.5 | Mar 20 | Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET) Affected: 4.14.0 and later |
| CVE-2022-40982 | 6.5 | Aug 11 | Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to… Affected: All versions, or not specified |
| CVE-2022-42334 | 6.5 | Mar 21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To… Affected: 4.11.0 through 4.17.0 |
| CVE-2022-42317 | 6.5 | Nov 1 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… Affected: All versions, or not specified |
| CVE-2022-42312 | 6.5 | Nov 1 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… Affected: All versions, or not specified |
| CVE-2022-42311 | 6.5 | Nov 1 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… Affected: All versions, or not specified |
| CVE-2022-42314 | 6.5 | Nov 1 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… Affected: All versions, or not specified |
| CVE-2022-42315 | 6.5 | Nov 1 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… Affected: All versions, or not specified |
| CVE-2022-42316 | 6.5 | Nov 1 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… Affected: All versions, or not specified |
| CVE-2022-42321 | 6.5 | Nov 1 | Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g Affected: All versions, or not specified |
| CVE-2022-42313 | 6.5 | Nov 1 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… Affected: All versions, or not specified |
| CVE-2022-42319 | 6.5 | Nov 1 | Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate quite large amounts of memory temporarily Affected: 4.9.0 and later |
| CVE-2022-42318 | 6.5 | Nov 1 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… Affected: All versions, or not specified |
| CVE-2022-33746 | 6.5 | Oct 11 | P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size Affected: 4.13.0 through 4.16.1 |
| CVE-2022-29900 | 6.5 | Jul 12 | Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions Affected: All versions, or not specified |
| CVE-2021-28713 | 6.5 | Jan 5 | Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… Affected: All versions, or not specified |
| CVE-2021-28712 | 6.5 | Jan 5 | Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… Affected: All versions, or not specified |
| CVE-2021-28711 | 6.5 | Jan 5 | Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… Affected: All versions, or not specified |
| CVE-2021-28690 | 6.5 | Jun 29 | x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability Affected: 4.12 through 4.15.0; 4.15.0 |
| CVE-2021-28039 | 6.5 | Mar 5 | An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen Affected: All versions, or not specified |
| CVE-2020-29483 | 6.5 | Dec 15 | An issue was discovered in Xen through 4.14.x Affected: through 4.14.0 |
| CVE-2020-29568 | 6.5 | Dec 15 | An issue was discovered in Xen through 4.14.x Affected: through 4.14.1 |
| CVE-2020-25597 | 6.5 | Sep 23 | An issue was discovered in Xen through 4.14.x Affected: 4.4.0 through 4.14.0 |
| CVE-2020-15566 | 6.5 | Jul 7 | An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation Affected: 4.10.0 through 4.13.1 |
| CVE-2020-15564 | 6.5 | Jul 7 | An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_vcpu_info Affected: 4.8.0 through 4.13.1 |
| CVE-2020-15563 | 6.5 | Jul 7 | An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash Affected: 4.8.0 through 4.13.1 |
| CVE-2019-19582 | 6.5 | Dec 11 | An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit iteration is mishandled Affected: 4.8.0 through 4.12.1 |
| CVE-2019-19581 | 6.5 | Dec 11 | An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bounds access) because certain bit iteration is mishandled Affected: 4.8.0 through 4.12.1 |
| CVE-2019-18420 | 6.5 | Oct 31 | An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall Affected: through 4.12.1 |
| CVE-2019-17348 | 6.5 | Oct 8 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service because of an incompatibility between Process Context Identifiers (PCID)… Affected: through 4.11.2 |
| CVE-2019-17345 | 6.5 | Oct 8 | An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check… Affected: 4.8.0 through 4.11.2 |
| CVE-2019-17344 | 6.5 | Oct 8 | An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service by leveraging a long-running operation that exists to support… Affected: through 4.11.2 |
| CVE-2019-17351 | 6.5 | Oct 8 | An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of… Affected: through 4.12.1 |
| CVE-2018-19967 | 6.5 | Dec 8 | An issue was discovered in Xen through 4.11.x on Intel x86 platforms allowing guest OS users to cause a denial of service (host OS hang) because Xen does not work around Intel's… Affected: through 4.11.1 |