spice-space records
9 published records for vendor spice-space.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')2
- CWE-770 Allocation of Resources Without Limits or Throttling2
- CWE-190 Integer Overflow or Wraparound1
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')1
- CWE-862 Missing Authorization1
- CWE-416 Use After Free1
The weakness classes this vendor ships most often: where to look.
CWEAll records
9 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
34Monitor | CVE-2020-23793No exploit | An issue was discovered in spice-server spice-server-0.14.0-6.el7_6.1.x86_64 of Redhat's VDI product.spice-space · spice-server · CWE-862 | High8.6 | 0.8%Aug 22, 2023 |
31Monitor | CVE-2017-15108No exploit | spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with accesspice-space · spice-vdagent · CWE-78 | High7.8 | 0.4%Jan 19, 2018 |
25Monitor | CVE-2020-25653No exploit | A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections.spice-space · spice-vdagent · CWE-362 | Medium6.3 | 0.3%Nov 25, 2020 |
25Monitor | CVE-2021-3700No exploit | A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredispice-space · usbredir · CWE-416 | Medium6.4 | 0.3%Feb 24, 2022 |
25Monitor | CVE-2020-25651No exploit | A flaw was found in the SPICE file transfer protocol.spice-space · spice-vdagent · CWE-362 | Medium6.4 | 0.2%Nov 25, 2020 |
22Monitor | CVE-2020-25650No exploit | A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine.spice-space · spice-vdagent · CWE-770 | Medium5.5 | 0.4%Nov 25, 2020 |
22Monitor | CVE-2020-25652No exploit | A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domaspice-space · spice-vdagent · CWE-770 | Medium5.5 | 0.4%Nov 25, 2020 |
20Monitor | CVE-2026-57965No exploit | Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflowredhat · enterprise linux · CWE-190 | Medium5.1 | 0.1%Jun 29, 2026 |
17Monitor | CVE-2026-57966No exploit | Spice-vdagent: path traversal in file transfer via unsanitized filenameredhat · enterprise linux · CWE-22 | Medium4.4 | 0.1%Jun 29, 2026 |
- CVE-2020-2379334Monitor
An issue was discovered in spice-server spice-server-0.14.0-6.el7_6.1.x86_64 of Redhat's VDI product.
HighCVSS 8.6No exploitEPSS 0%spice-space · spice-serverAug 22, 2023
- CVE-2017-1510831Monitor
spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with acces
HighCVSS 7.8No exploitEPSS 0%spice-space · spice-vdagentJan 19, 2018
- CVE-2020-2565325Monitor
A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections.
MediumCVSS 6.3No exploitEPSS 0%spice-space · spice-vdagentNov 25, 2020
- CVE-2021-370025Monitor
A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredi
MediumCVSS 6.4No exploitEPSS 0%spice-space · usbredirFeb 24, 2022
- CVE-2020-2565125Monitor
A flaw was found in the SPICE file transfer protocol.
MediumCVSS 6.4No exploitEPSS 0%spice-space · spice-vdagentNov 25, 2020
- CVE-2020-2565022Monitor
A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine.
MediumCVSS 5.5No exploitEPSS 0%spice-space · spice-vdagentNov 25, 2020
- CVE-2020-2565222Monitor
A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX doma
MediumCVSS 5.5No exploitEPSS 0%spice-space · spice-vdagentNov 25, 2020
- CVE-2026-5796520Monitor
Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow
MediumCVSS 5.1No exploitEPSS 0%redhat · enterprise linuxJun 29, 2026
- CVE-2026-5796617Monitor
Spice-vdagent: path traversal in file transfer via unsanitized filename
MediumCVSS 4.4No exploitEPSS 0%redhat · enterprise linuxJun 29, 2026