Where
AND
AND
-Infinity
0

Trending

Last week
Last month
Last year

redhat/kernel-rtLast updated 25 April 2025

Risk 81
Severity
9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A remote stack overflow in the TIPC networking module. With FORTIFYSOURCE's stricter memcpy() bounds checking, this can be exploited to cause remote DOS via kernel panic on systems using TIPC. Prior to these bounds checks, and with a canary leak (or no CONFIGSTACKPROTECTOR), this can be exploited for RCE.

Reference: https://www.openwall.com/lists/oss-security/2022/02/10/1

1 / 4
Source: Red Hat

Remedy

The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions: # echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable.

Remedy

Ensure the tipc module is not loaded; unlike many other network protocols in the Linux kernel, the tipc module cannot be auto-loaded by an unprivileged user.
First published (updated )
CVE-2022-0435

redhat/jbcs-httpd24-httpdmod_proxy SSRF

Risk 96
Severity
9
Exploited
SSRF
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

A crafted request uri-path can cause modproxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

1 / 3
First published (updated )
CVE-2021-40438

redhat/phpUnderflow in PHP-FPM can lead to RCE

Risk 99
Severity
9.8
Exploited
Input Validation
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

apachemodphp. Multiple issues were addressed by updating to PHP version 7.3.11.

1 / 6
First published (updated )
CVE-2019-11043

redhat/sudoLast updated 25 August 2025

Risk 81
Severity
9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A flaw was found in sudo before version 1.8.28. When sudo is configured to allow a user to run commands as an arbitrary user via the 'ALL' keyword in a 'Runas' specification, it is possible to run commands as root.

1 / 4
Source: Red Hat

Remedy

This vulnerability only affects configurations of sudo that have a runas user list that includes an exclusion of root. The most simple example is: ~~~ someuser ALL=(ALL, !root) /usr/bin/somecommand ~~~ The exclusion is specified using an excalamation mark (!). In this example, the "root" user is specified by name. The root user may also be identified in other ways, such as by user id: ~~~ someuser ALL=(ALL, !#0) /usr/bin/somecommand ~~~ or by reference to a runas alias: ~~~ Runas_Alias MYGROUP = root, adminuser someuser ALL=(ALL, !MYGROUP) /usr/bin/somecommand ~~~ To ensure your sudoers configuration is not affected by this vulnerability, we recommend examining each sudoers entry that includes the `!` character in the runas specification, to ensure that the root user is not among the exclusions. These can be found in the /etc/sudoers file or files under /etc/sudoers.d.
First published (updated )
CVE-2019-14287

Gnome PangoBuffer Overflow

Risk 90
Severity
9.8
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pangolog2visgetembeddinglevels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pangoitemize.

1 / 3
Source: Launchpad
First published (updated )
CVE-2019-1010238

redhat/cyrus-imapdLast updated 25 August 2025

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Last updated 25 August 2025

1 / 3
Source: Ubuntu
First published (updated )
CVE-2019-11356

redhat/kernel-rtBuffer Overflow

Risk 89
Severity
9.8
Buffer Overflow
AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiexuapparsetailies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences.

1 / 4
First published (updated )
CVE-2019-10126

IBM Security GuardiumRace Condition

Risk 91
Severity
9.8
Race Condition
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 creates new files with default permissions and set the correct permissions after the operation is finished. This might cause that the files can be accessible by more users during the operation than expected.

Upstream Commit:

https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174

1 / 4
Source: Red Hat
First published (updated )
CVE-2019-12450

redhat/pythonPath Traversal

Risk 69
Severity
9.1
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Last updated 25 August 2025

1 / 3
Source: Ubuntu

Remedy

If your application uses a blacklist to prevent "file://" schema from being used, consider using a whitelist approach to just allow the schemas you want or add "local_file://" schema to your blacklist.
First published (updated )
CVE-2019-9948

Mozilla FirefoxLast updated 25 August 2025

Risk 90
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Last updated 25 August 2025

1 / 4
Source: Ubuntu
First published (updated )
CVE-2019-9792

Mozilla FirefoxLast updated 25 August 2025

Risk 90
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Last updated 25 August 2025

1 / 4
Source: Ubuntu
First published (updated )
CVE-2019-9791

Mozilla FirefoxLast updated 25 August 2025

Risk 90
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Last updated 25 August 2025

1 / 5
Source: Ubuntu
First published (updated )
CVE-2019-9788

redhat/pythonLast updated 25 August 2025

Risk 89
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in Python 2.7.x through 2.7.16 and 3.x through 3.7.2. An improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization could lead to an Information Disclosure (credentials, cookies, etc. that are cached against a given hostname) in the urllib.parse.urlsplit, urllib.parse.urlparse components. A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.

References: https://bugs.python.org/issue36216 https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html

Uptream Patch: https://github.com/python/cpython/pull/12201

1 / 4
Source: Red Hat
First published (updated )
CVE-2019-9636

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203