Skip to content
Noroxi

Xen records

497 published records for vendor xen.

Researcher profile

Entered KEV
0 · 0%
Weaponized
3 · 0.6%
Pre-auth RCE
1
With a fix record
94.8%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

497 records
  • CVE-2015-5165
    41Plan

    The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to

    CriticalCVSS 9.3No exploitEPSS 13%

    xen · xenAug 12, 2015

  • CVE-2017-10918
    41Plan

    Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obtain privileged host

    CriticalCVSS 10.0No exploitEPSS 3%

    xen · xenJul 4, 2017

  • CVE-2017-10912
    41Plan

    Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217.

    CriticalCVSS 10.0No exploitEPSS 2%

    xen · xenJul 4, 2017

  • CVE-2017-10920
    41Plan

    The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and GNTMAP_host_map mapping, when followed by only a GNTMAP_host

    CriticalCVSS 10.0No exploitEPSS 2%

    xen · xenJul 4, 2017

  • CVE-2017-10921
    41Plan

    The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and GNTMAP_host_map mapping, whi

    CriticalCVSS 10.0No exploitEPSS 2%

    xen · xenJul 4, 2017

  • CVE-2015-8104
    41Plan

    The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host O

    CriticalCVSS 10.0No exploitEPSS 2%

    xen · xenNov 16, 2015

  • CVE-2012-0217
    40Plan

    The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Orac

    HighCVSS 7.2WeaponizedEPSS 39%

    xen · xenJun 12, 2012

  • CVE-2018-8897
    40Plan

    A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the

    HighCVSS 7.8WeaponizedEPSS 18%

    debian · debian linuxMay 8, 2018

  • CVE-2017-2620
    40Plan

    Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue.

    CriticalCVSS 9.9No exploitEPSS 3%

    qemu · qemuJul 27, 2018

  • CVE-2017-10913
    40Plan

    The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, which allows bac

    CriticalCVSS 9.8No exploitEPSS 2%

    xen · xenJul 4, 2017

  • CVE-2019-18425
    40Plan

    An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descript

    CriticalCVSS 9.8No exploitEPSS 2%

    xen · xenOct 31, 2019

  • CVE-2018-12892
    40Plan

    An issue was discovered in Xen 4.7 through 4.10.x.

    CriticalCVSS 9.9No exploitEPSS 2%

    xen · xenJul 2, 2018

  • CVE-2012-5525
    40Plan

    The get_page_from_gfn hypercall function in Xen 4.2 allows local PV guest OS administrators to cause a denial of service (crash) via a craft

    MediumCVSS 4.7WeaponizedEPSS 1%

    xen · xenDec 13, 2012

  • CVE-2025-58142
    39Monitor

    Mutiple vulnerabilities in the Viridian interface

    CriticalCVSS 9.8No exploitEPSS 0%

    xen · xenSep 11, 2025

  • CVE-2025-27466
    39Monitor

    Mutiple vulnerabilities in the Viridian interface

    CriticalCVSS 9.8No exploitEPSS 0%

    xen · xenSep 11, 2025

  • CVE-2025-58143
    39Monitor

    Mutiple vulnerabilities in the Viridian interface

    CriticalCVSS 9.8No exploitEPSS 0%

    xen · xenSep 11, 2025

  • CVE-2017-2615
    37Monitor

    Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue.

    CriticalCVSS 9.1No exploitEPSS 3%

    qemu · qemuJul 2, 2018

  • CVE-2017-15597
    37Monitor

    An issue was discovered in Xen through 4.9.x.

    CriticalCVSS 9.1No exploitEPSS 2%

    xen · xenOct 30, 2017

  • CVE-2017-10917
    37Monitor

    Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service

    CriticalCVSS 9.1No exploitEPSS 2%

    xen · xenJul 4, 2017

  • CVE-2017-10915
    37Monitor

    The shadow-paging feature in Xen through 4.8.x mismanages page references and consequently introduces a race condition, which allows guest O

    CriticalCVSS 9.0No exploitEPSS 1%

    xen · xenJul 4, 2017

  • CVE-2022-4949
    36Monitor

    AdSanity < 1.8.2 - Authenticated Arbitrary File Upload

    HighCVSS 8.8No exploitEPSS 2%

    adsanityplugin · adsanityJun 6, 2023

  • CVE-2019-18423
    36Monitor

    An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall

    HighCVSS 8.8No exploitEPSS 2%

    xen · xenOct 31, 2019

  • CVE-2019-18422
    36Monitor

    An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the

    HighCVSS 8.8No exploitEPSS 1%

    xen · xenOct 31, 2019

  • CVE-2024-31142
    35Monitor

    x86: Incorrect logic for BTC/SRSO mitigations

    HighCVSS 7.5No exploitEPSS 17%

    xen · xenMay 16, 2024

  • CVE-2015-3456
    35Monitor

    The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (o

    HighCVSS 7.7Proof of conceptEPSS 15%

    qemu · qemuMay 13, 2015