CVE-2023-47003 | Critical | 9.8 | 2023-11-16 | An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlock_ItemIsDeleted. |
CVE-2023-47004 | High | 8.8 | 2023-11-06 | Buffer Overflow vulnerability in Redis RedisGraph v.2.x through v.2.12.8 and fixed in v.2.12.9 allows an attacker to execute arbitrary code via the code logic… |
CVE-2020-21468 | High | 7.5 | 2021-09-20 | A segmentation fault in the redis-server component of Redis 5.0.7 leads to a denial of service (DOS). NOTE: the vendor cannot reproduce this issue in a release… |
CVE-2021-32761 | High | 7.5 | 2021-07-21 | Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with… |
CVE-2021-32625 | High | 7.5 | 2021-06-02 | Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version… |
CVE-2021-29478 | High | 7.5 | 2021-05-04 | Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis 6.2 bef… |
CVE-2021-29477 | High | 7.5 | 2021-05-04 | Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. An integer overflow bug in Redis version… |
CVE-2021-3470 | Medium | 5.3 | 2021-03-31 | A heap overflow issue was found in Redis in versions before 5.0.10, before 6.0.9 and before 6.2.0 when using a heap allocator other than jemalloc or glibc's ma… |
CVE-2021-21309 | Medium | 5.4 | 2021-02-26 | Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug in 32-bit Redis version 4.0 or newer c… |
CVE-2020-35668 | High | 7.5 | 2020-12-23 | RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference that leads to a server crash because it mishandles an unquoted string, such as an alias that has n… |
CVE-2020-14147 | High | 7.7 | 2020-06-15 | An integer overflow in the getnum function in lua_struct.c in Redis before 6.0.3 allows context-dependent attackers with permission to run Lua code in a Redis… |
CVE-2020-7105 | High | 7.5 | 2020-01-16 | async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked. |
CVE-2013-0180 | Medium | 5.5 | 2019-11-01 | Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds. |
CVE-2013-0178 | Medium | 5.5 | 2019-11-01 | Insecure temporary file vulnerability in Redis before 2.6 related to /tmp/redis-%p.vm. |
CVE-2019-10193 | High | 7.2 | 2019-07-11 | A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By… |
CVE-2019-10192 | High | 7.2 | 2019-07-11 | A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By c… |
CVE-2018-11219 | Critical | 9.8 | 2018-06-17 | An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading… |
CVE-2018-11218 | Critical | 9.8 | 2018-06-17 | Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stac… |
CVE-2018-12326 | High | 8.4 | 2018-06-17 | Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a… |
CVE-2018-12453 | High | 7.5 | 2018-06-16 | Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP… |
CVE-2016-10517 | High | 7.4 | 2017-10-24 | networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis prot… |
CVE-2017-15047 | Critical | 9.8 | 2017-10-06 | The clusterLoadConfig function in cluster.c in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) or p… |
CVE-2016-8339 | Critical | 9.8 | 2016-10-28 | A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in… |
CVE-2013-7458 | Low | 3.3 | 2016-08-10 | linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by re… |
CVE-2015-8080 | High | 7.5 | 2016-04-13 | Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission… |
CVE-2015-4335 | | | 2015-06-09 | Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command. |