Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

8.8

HIGH

CVE-2018-10884

Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery (CSRF) in awx/api/authentication.py. An attacker could exploit this by tricking already authenticated users into visiting a malicious site and hijacking the authtoke...

Affected Products : ansible_tower
Published: Aug. 22, 2018

Modified: Nov. 21, 2024
5.5

MEDIUM

CVE-2018-10883

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image....

Affected Products : linux_kernel ubuntu_linux enterprise_linux debian_linux enterprise_linux_desktop enterprise_linux_server enterprise_linux_workstation
Published: Jul. 30, 2018

Modified: Nov. 21, 2024
5.5

MEDIUM

CVE-2018-10882

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image....

Affected Products : linux_kernel ubuntu_linux enterprise_linux debian_linux
Published: Jul. 27, 2018

Modified: Nov. 21, 2024
5.5

MEDIUM

CVE-2018-10881

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image....

Affected Products : linux_kernel ubuntu_linux debian_linux enterprise_linux_desktop enterprise_linux_server enterprise_linux_workstation enterprise_linux_for_real_time enterprise_linux_for_real_time_for_nfv
Published: Jul. 26, 2018

Modified: Nov. 21, 2024
7.1

HIGH

CVE-2018-10880

Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service....

Affected Products : linux_kernel ubuntu_linux enterprise_linux debian_linux
Published: Jul. 25, 2018

Modified: Nov. 21, 2024
7.8

HIGH

CVE-2018-10879

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image....

Affected Products : linux_kernel ubuntu_linux enterprise_linux debian_linux enterprise_linux_desktop enterprise_linux_server enterprise_linux_workstation
Published: Jul. 26, 2018

Modified: Nov. 21, 2024
7.8

HIGH

CVE-2018-10878

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4 filesystem image....

Affected Products : linux_kernel ubuntu_linux debian_linux enterprise_linux_desktop enterprise_linux_server enterprise_linux_workstation
Published: Jul. 26, 2018

Modified: Nov. 21, 2024
7.3

HIGH

CVE-2018-10877

Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image....

Affected Products : linux_kernel ubuntu_linux enterprise_linux debian_linux
Published: Jul. 18, 2018

Modified: Nov. 21, 2024
5.5

MEDIUM

CVE-2018-10876

A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image....

Affected Products : linux_kernel ubuntu_linux debian_linux
Published: Jul. 26, 2018

Modified: Nov. 21, 2024
7.8

HIGH

CVE-2018-10875

A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code....

Affected Products : ubuntu_linux debian_linux openstack ceph_storage ansible_engine gluster_storage openshift virtualization virtualization_host package_hub +1 more products
Published: Jul. 13, 2018

Modified: Nov. 21, 2024
7.8

HIGH

CVE-2018-10874

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result....

Affected Products : openstack ansible_engine virtualization virtualization_host
Published: Jul. 02, 2018

Modified: Nov. 21, 2024
8.8

HIGH

CVE-2018-10873

A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer w...

Affected Products : ubuntu_linux debian_linux enterprise_linux_desktop enterprise_linux_server enterprise_linux_workstation enterprise_linux_server_aus enterprise_linux_server_eus enterprise_linux_server_tus virtualization virtualization_host +1 more products
Published: Aug. 17, 2018

Modified: Nov. 21, 2024
6.5

MEDIUM

CVE-2018-10872

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once th...

Affected Products : linux_kernel enterprise_linux enterprise_linux_desktop enterprise_linux_server enterprise_linux_workstation
Published: Jul. 10, 2018

Modified: Nov. 21, 2024
7.2

HIGH

CVE-2018-10871

389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective chang...

Affected Products : debian_linux 389_directory_server
Published: Jul. 18, 2018

Modified: Nov. 21, 2024
9.8

CRITICAL

CVE-2018-10870

redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution....

Affected Products : enterprise_linux certification
Published: Jul. 19, 2018

Modified: Nov. 21, 2024
7.5

HIGH

CVE-2018-10869

redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd....

Affected Products : enterprise_linux certification
Published: Jul. 19, 2018

Modified: Nov. 21, 2024
7.5

HIGH

CVE-2018-10868

redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a "Billion Laugh Attack" by replying to XMLRPC methods when getting the status of an host....

Affected Products : certification
Published: May. 26, 2021

Modified: Nov. 21, 2024
9.1

CRITICAL

CVE-2018-10867

Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file accessible by the apached user....

Affected Products : certification
Published: May. 26, 2021

Modified: Nov. 21, 2024
9.1

CRITICAL

CVE-2018-10866

It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remove a "system" file, that is an xml file with host related information, not belonging to him....

Affected Products : certification
Published: May. 26, 2021

Modified: Nov. 21, 2024
7.5

HIGH

CVE-2018-10865

It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to call a "restart" RPC method on any host accessible by the system, even if not belonging to him....

Affected Products : certification
Published: May. 26, 2021

Modified: Nov. 21, 2024

Showing 20 of 293656 Results

Browse by Apps

Latest CVE Feed

8.8

5.5

5.5

5.5

7.1

7.8

7.8

7.3

5.5

7.8

7.8

8.8

6.5

7.2

9.8

7.5

7.5

9.1

9.1

7.5

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable