Linuxfoundation
Page 4 of 6 — Linuxfoundation CVEs from a corpus of 557, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-47090 | Medium | 6.5 | 2023-10-30 | NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for u… |
CVE-2023-32829 | Medium | 6.7 | 2023-10-02 | In apusys, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-32820 | High | 7.5 | 2023-10-02 | In wlan firmware, there is a possible firmware assertion due to improper input handling. This could lead to remote denial of service with no additional executi… |
CVE-2023-43632 | Critical | 9.0 | 2023-09-21 | As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the cli… |
CVE-2023-43631 | High | 8.8 | 2023-09-21 | On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is present, and contains a supported public… |
CVE-2023-43636 | High | 8.8 | 2023-09-20 | In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot” d… |
CVE-2023-43635 | High | 8.8 | 2023-09-20 | Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. Different parts of the system update… |
CVE-2023-43630 | High | 8.8 | 2023-09-20 | PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7f… |
CVE-2022-28357 | Critical | 9.8 | 2023-09-19 | NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account. |
CVE-2023-32815 | Medium | 4.4 | 2023-09-04 | In gnss service, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution… |
CVE-2023-32813 | Medium | 4.4 | 2023-09-04 | In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local information disclosure with System executio… |
CVE-2023-32812 | Medium | 6.7 | 2023-09-04 | In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local esclation of privileges with System executi… |
CVE-2023-32811 | Medium | 6.7 | 2023-09-04 | In connectivity system driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with… |
CVE-2023-32810 | Medium | 4.4 | 2023-09-04 | In bluetooth driver, there is a possible out of bounds read due to improper input validation. This could lead to local information leak with System execution p… |
CVE-2023-32807 | Medium | 4.4 | 2023-09-04 | In wlan service, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution… |
CVE-2023-32806 | Medium | 6.7 | 2023-09-04 | In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System executio… |
CVE-2023-20850 | Medium | 6.5 | 2023-09-04 | In imgsys_cmdq, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System exe… |
CVE-2023-20849 | Medium | 6.5 | 2023-09-04 | In imgsys_cmdq, there is a possible use after free due to a missing valid range checking. This could lead to local escalation of privilege with System executio… |
CVE-2023-20848 | Medium | 6.5 | 2023-09-04 | In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local escalation of privilege with System exec… |
CVE-2023-20847 | Medium | 4.2 | 2023-09-04 | In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local denial of service with System execution… |
CVE-2023-20846 | Medium | 4.2 | 2023-09-04 | In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execu… |
CVE-2023-20845 | Medium | 4.2 | 2023-09-04 | In imgsys, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution… |
CVE-2023-20844 | Medium | 4.2 | 2023-09-04 | In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execu… |
CVE-2023-20843 | Medium | 4.2 | 2023-09-04 | In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execu… |
CVE-2023-20842 | Medium | 6.5 | 2023-09-04 | In imgsys_cmdq, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System exe… |
CVE-2023-20841 | Medium | 6.5 | 2023-09-04 | In imgsys, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System executio… |
CVE-2023-20840 | Medium | 6.5 | 2023-09-04 | In imgsys, there is a possible out of bounds read and write due to a missing valid range checking. This could lead to local escalation of privilege with System… |
CVE-2023-20839 | Medium | 4.2 | 2023-09-04 | In imgsys, there is a possible out of bounds read due to a missing valid range checking. This could lead to local information disclosure with System execution… |
CVE-2023-20838 | Medium | 4.0 | 2023-09-04 | In imgsys, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with System execution privileges nee… |
CVE-2023-20835 | Medium | 6.4 | 2023-09-04 | In camsys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20832 | Medium | 6.7 | 2023-09-04 | In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20831 | Medium | 6.7 | 2023-09-04 | In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20830 | Medium | 6.7 | 2023-09-04 | In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20829 | Medium | 6.7 | 2023-09-04 | In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20828 | Medium | 6.7 | 2023-09-04 | In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20821 | Medium | 6.7 | 2023-09-04 | In nvram, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privile… |
CVE-2023-39348 | Medium | 4.0 | 2023-08-28 | Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL always. It's recommend… |
CVE-2023-39951 | Medium | 6.5 | 2023-08-08 | OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. OpenTelemetry Java Instrumentation prior… |
CVE-2023-20805 | Medium | 6.7 | 2023-08-07 | In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2023-20804 | Medium | 6.7 | 2023-08-07 | In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2023-20803 | Medium | 6.5 | 2023-08-07 | In imgsys, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with System execution privi… |
CVE-2023-20802 | Medium | 6.5 | 2023-08-07 | In imgsys, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with System execution privi… |
CVE-2023-20801 | Medium | 6.4 | 2023-08-07 | In imgsys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20800 | Medium | 6.5 | 2023-08-07 | In imgsys, there is a possible system crash due to a mssing ptr check. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2023-20796 | Medium | 4.4 | 2023-08-07 | In power, there is a possible memory corruption due to an incorrect bounds check. This could lead to local denial of service with System execution privileges n… |
CVE-2023-20790 | Medium | 4.4 | 2023-08-07 | In nvram, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with System execution privileg… |
CVE-2023-37918 | Medium | 6.8 | 2023-07-21 | Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypas… |
CVE-2023-37264 | Low | 3.7 | 2023-07-07 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, wh… |
CVE-2023-20693 | High | 7.5 | 2023-07-04 | In wlan firmware, there is possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privile… |
CVE-2023-20692 | High | 7.5 | 2023-07-04 | In wlan firmware, there is possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privile… |
CVE-2023-20691 | High | 7.5 | 2023-07-04 | In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privilege… |
CVE-2023-20690 | High | 7.5 | 2023-07-04 | In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privilege… |
CVE-2023-20689 | High | 7.5 | 2023-07-04 | In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privilege… |
CVE-2022-32666 | High | 7.5 | 2023-07-04 | In Wi-Fi, there is a possible low throughput due to misrepresentation of critical information. This could lead to remote denial of service with no additional e… |
CVE-2023-35926 | High | 8.0 | 2023-06-22 | Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by… |
CVE-2023-20747 | Medium | 4.4 | 2023-06-06 | In vcu, there is a possible memory corruption due to type confusion. This could lead to local denial of service with System execution privileges needed. User i… |
CVE-2023-20746 | Medium | 6.7 | 2023-06-06 | In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges need… |
CVE-2023-20745 | Medium | 6.7 | 2023-06-06 | In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges need… |
CVE-2023-20744 | Medium | 6.7 | 2023-06-06 | In vcu, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User… |
CVE-2023-20743 | Medium | 6.7 | 2023-06-06 | In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges need… |
CVE-2023-20740 | Medium | 6.7 | 2023-06-06 | In vcu, there is a possible memory corruption due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2023-20738 | Medium | 6.7 | 2023-06-06 | In vcu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20737 | Medium | 6.7 | 2023-06-06 | In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2023-20736 | Medium | 6.4 | 2023-06-06 | In vcu, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges need… |
CVE-2023-20735 | Medium | 6.7 | 2023-06-06 | In vcu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20734 | Medium | 6.7 | 2023-06-06 | In vcu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2023-20733 | Medium | 6.7 | 2023-06-06 | In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2023-20732 | Medium | 6.7 | 2023-06-06 | In wlan, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-20731 | Medium | 4.4 | 2023-06-06 | In wlan, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-20730 | Medium | 4.4 | 2023-06-06 | In wlan, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-20729 | Medium | 4.4 | 2023-06-06 | In wlan, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-20728 | Medium | 4.4 | 2023-06-06 | In wlan, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-20716 | Medium | 6.7 | 2023-06-06 | In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2023-20715 | Medium | 6.7 | 2023-06-06 | In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2023-20712 | Medium | 6.7 | 2023-06-06 | In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2023-20727 | Medium | 4.4 | 2023-06-06 | In wlan, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges… |
CVE-2023-32684 | Low | 2.7 | 2023-05-30 | Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to version 0.16.0, a virtual machine instance with a malicious disk ima… |
CVE-2023-33199 | Medium | 5.3 | 2023-05-26 | Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of… |
CVE-2023-24805 | High | 8.8 | 2023-05-17 | cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use… |
CVE-2023-20726 | Low | 3.3 | 2023-05-15 | In mnld, there is a possible leak of GPS location due to a missing permission check. This could lead to local information disclosure with no additional executi… |
CVE-2023-29195 | Medium | 4.1 | 2023-05-11 | Vitess is a database clustering system for horizontal scaling of MySQL through generalized sharding. Prior to version 16.0.2, users can either intentionally or… |
CVE-2023-30840 | Medium | 5.8 | 2023-05-08 | Fluid is an open source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. Starting in version 0.7.0 and prior… |
CVE-2023-30551 | High | 7.5 | 2023-05-08 | Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading… |
CVE-2023-30841 | Medium | 6.0 | 2023-04-26 | Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Bare… |
CVE-2023-2250 | Medium | 6.7 | 2023-04-24 | A flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes which has the cluster-manager-registration-controller or clus… |
CVE-2023-22645 | High | 8.0 | 2023-04-19 | An Improper Privilege Management vulnerability in SUSE kubewarden allows attackers to read arbitrary secrets if they get access to the ServiceAccount kubewarde… |
CVE-2023-29194 | Medium | 4.1 | 2023-04-14 | Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing `/` charac… |
CVE-2023-29018 | High | 8.0 | 2023-04-14 | The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code exe… |
CVE-2023-30512 | Medium | 6.5 | 2023-04-12 | CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets… |
CVE-2023-28642 | Medium | 6.1 | 2023-03-29 | runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the c… |
CVE-2023-25809 | Medium | 5.0 | 2023-03-29 | runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/… |
CVE-2022-41354 | Medium | 4.3 | 2023-03-27 | An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications. |
CVE-2023-27561 | High | 7.0 | 2023-03-03 | runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must… |
CVE-2021-4326 | Low | 3.3 | 2023-03-01 | A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or… |
CVE-2022-48363 | High | 7.5 | 2023-02-26 | In MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain situations involving… |
CVE-2021-32163 | Critical | 9.8 | 2023-02-17 | Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization. |
CVE-2023-25173 | Medium | 5.3 | 2023-02-16 | containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up pro… |
CVE-2023-25153 | Medium | 6.2 | 2023-02-16 | containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read… |
CVE-2023-25571 | Medium | 6.8 | 2023-02-14 | Backstage is an open platform for building developer portals. `@backstage/catalog-model` prior to version 1.2.0, `@backstage/core-components` prior to 0.12.4… |
CVE-2023-25151 | High | 7.5 | 2023-02-08 | opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelh… |