Lucene search
+L
DebiancveMost viewed

61371 matches found

Debian CVE
Debian CVE
•added 2024/04/23 8:23 p.m.•88 views

CVE-2024-32875

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The...

6.1CVSS6.1AI score0.00537EPSS
Exploits0
Debian CVE
Debian CVE
•added 2024/01/28 12:19 p.m.•88 views

CVE-2023-6200

A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution...

7.5CVSS7.7AI score0.02166EPSS
Exploits0
Debian CVE
Debian CVE
•added 2024/01/05 4:18 p.m.•88 views

CVE-2023-34322

For migration as well as to work around kernels unaware of L1TF see XSA-273, PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on th...

7.8CVSS5.2AI score0.0023EPSS
Exploits0
Debian CVE
Debian CVE
•added 2023/12/19 2:9 p.m.•88 views

CVE-2023-6931

A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perfevent's readsize can overflow, leading to an heap out-of-bounds increment or write in perfreadgroup. We recommend upgrading past commit...

7.8CVSS6.7AI score0.00715EPSS
Exploits1
Debian CVE
Debian CVE
•added 2023/11/30 9:17 p.m.•88 views

CVE-2023-49735

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

7.5CVSS7.5AI score0.01345EPSS
Exploits0
Debian CVE
Debian CVE
•added 2023/10/23 6:50 a.m.•88 views

CVE-2023-45802

When a HTTP/2 stream was reset RST frame by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing...

5.9CVSS6.6AI score0.03024EPSS
Exploits1
Debian CVE
Debian CVE
•added 2023/08/22 12:0 a.m.•88 views

CVE-2022-37052

A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject...

6.5CVSS6AI score0.00902EPSS
Exploits1
Debian CVE
Debian CVE
•added 2023/07/26 12:0 a.m.•88 views

CVE-2023-38285

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity...

7.5CVSS7.5AI score0.00771EPSS
Exploits0
Debian CVE
Debian CVE
•added 2023/05/17 12:0 a.m.•88 views

CVE-2023-2203

A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of...

8.8CVSS8.6AI score0.00934EPSS
Exploits0
Debian CVE
Debian CVE
•added 2023/05/12 12:0 a.m.•88 views

CVE-2023-31916

Removed by vendor...

5.5CVSS5.5AI score0.00332EPSS
Exploits1
Debian CVE
Debian CVE
•added 2023/03/29 12:0 a.m.•88 views

CVE-2022-48434

libavcodec/pthreadframe.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances e.g., hardware re-initialization upon a mid-video SPS change when...

8.1CVSS7.1AI score0.01512EPSS
Exploits1
Debian CVE
Debian CVE
•added 2023/03/19 12:0 a.m.•88 views

CVE-2022-48423

In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur...

7.8CVSS7.7AI score0.00266EPSS
Exploits0
Debian CVE
Debian CVE
•added 2023/02/28 5:54 p.m.•88 views

CVE-2023-1018

An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM...

5.5CVSS6.6AI score0.05552EPSS
Exploits0
Debian CVE
Debian CVE
•added 2023/02/16 12:0 a.m.•88 views

CVE-2021-23980

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False Note: none of the above tags are in the default allowe...

6.1CVSS6.3AI score0.00483EPSS
Exploits1
Debian CVE
Debian CVE
•added 2023/01/30 12:0 a.m.•88 views

CVE-2022-48303

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in fromheader in list.c via a V7 archive in which mtime has approximately 11 whitespace...

5.5CVSS6.5AI score0.04524EPSS
Exploits1
Debian CVE
Debian CVE
•added 2022/12/14 12:0 a.m.•88 views

CVE-2022-3115

An issue was discovered in the Linux kernel through 5.16-rc6. malidpcrtcreset in drivers/gpu/drm/arm/malidpcrtc.c lacks check of the return value of kzalloc and will cause the null pointer dereference...

5.5CVSS6.8AI score0.00217EPSS
Exploits0
Debian CVE
Debian CVE
•added 2022/09/21 12:0 a.m.•88 views

CVE-2022-37026

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS...

9.8CVSS9.5AI score0.01211EPSS
Exploits0
Debian CVE
Debian CVE
•added 2022/09/16 9:40 p.m.•88 views

CVE-2022-35984

TensorFlow is an open source platform for machine learning. ParameterizedTruncatedNormal assumes shape is of type int32. A valid shape of type int64 results in a mismatched type CHECK fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit...

7.5CVSS6.8AI score0.00411EPSS
Exploits0
Debian CVE
Debian CVE
•added 2022/09/16 10:0 a.m.•88 views

CVE-2022-40152

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

7.5CVSS6AI score0.19653EPSS
Exploits1
Debian CVE
Debian CVE
•added 2022/09/08 10:8 p.m.•88 views

CVE-2019-25076

The TSS Tuple Space Search algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a denial of service delays of legitimate traffic via crafted packet data that requires excessive evaluation time within the packet classification algorithm for the MegaFlow cache, ak...

5.8CVSS5.8AI score0.01836EPSS
Exploits1
Debian CVE
Debian CVE
•added 2022/08/26 12:0 a.m.•88 views

CVE-2022-0216

A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsidomsgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU...

4.4CVSS5.9AI score0.00405EPSS
Exploits1
Debian CVE
Debian CVE
•added 2022/07/20 12:0 a.m.•88 views

CVE-2022-31160

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents...

6.1CVSS6.6AI score0.02475EPSS
Exploits1
Debian CVE
Debian CVE
•added 2022/07/14 2:51 p.m.•88 views

CVE-2022-32210

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via...

6.5CVSS6.4AI score0.0044EPSS
Exploits1
Debian CVE
Debian CVE
•added 2022/07/06 11:5 a.m.•88 views

CVE-2022-35230

An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...

5.4CVSS3.8AI score0.00714EPSS
Exploits0
Debian CVE
Debian CVE
•added 2022/05/17 12:0 a.m.•88 views

CVE-2022-28185

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an out-of-bounds write, which may lead to denial of service and data tampering...

7.1CVSS6.8AI score0.00302EPSS
Exploits0
Debian CVE
Debian CVE
•added 2022/05/01 3:25 p.m.•88 views

CVE-2022-21227

The package sqlite3 before 5.0.3 are vulnerable to Denial of Service DoS which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine...

7.5CVSS7.6AI score0.02068EPSS
Exploits0
Debian CVE
Debian CVE
•added 2022/04/05 12:25 a.m.•88 views

CVE-2022-0790

Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially perform a sandbox escape via a crafted HTML page...

9.6CVSS9.5AI score0.00918EPSS
Exploits0
Debian CVE
Debian CVE
•added 2022/03/23 7:46 p.m.•88 views

CVE-2021-4149

A vulnerability was found in btrfsalloctreeb in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service DOS due to a deadlock problem...

5.5CVSS6.2AI score0.004EPSS
Exploits1
Debian CVE
Debian CVE
•added 2022/03/16 2:4 p.m.•88 views

CVE-2021-39685

In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

7.8CVSS6.5AI score0.00461EPSS
Exploits2
Debian CVE
Debian CVE
•added 2022/03/16 2:3 p.m.•88 views

CVE-2021-39713

Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel...

7CVSS6.2AI score0.0021EPSS
Exploits1
Debian CVE
Debian CVE
•added 2022/03/10 2:50 p.m.•88 views

CVE-2021-33293

Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine in parser.c...

9.1CVSS9.2AI score0.02067EPSS
Exploits1
Debian CVE
Debian CVE
•added 2022/02/27 8:0 a.m.•88 views

CVE-2021-21708

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

9.8CVSS7.7AI score0.03002EPSS
Exploits1
Debian CVE
Debian CVE
•added 2022/02/22 12:0 a.m.•88 views

CVE-2022-25643

seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname...

9.8CVSS9.5AI score0.02108EPSS
Exploits0
Debian CVE
Debian CVE
•added 2022/02/18 2:50 p.m.•88 views

CVE-2022-23647

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted int...

7.5CVSS7AI score0.01479EPSS
Exploits0
Debian CVE
Debian CVE
•added 2022/02/09 10:4 p.m.•88 views

CVE-2021-0175

Removed by vendor...

6.5CVSS6AI score0.00515EPSS
Exploits0
Debian CVE
Debian CVE
•added 2022/02/04 10:32 p.m.•88 views

CVE-2022-23580

Tensorflow is an Open Source Machine Learning Framework. During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, a...

6.5CVSS7AI score0.00821EPSS
Exploits1
Debian CVE
Debian CVE
•added 2021/12/20 11:20 a.m.•88 views

CVE-2021-44224

A crafted URI sent to httpd configured as a forward proxy ProxyRequests on can cause a crash NULL pointer dereference or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint Server Side Request Forgery...

8.2CVSS7.2AI score0.82295EPSS
Exploits0
Debian CVE
Debian CVE
•added 2021/10/11 6:45 p.m.•88 views

CVE-2021-42252

An issue was discovered in aspeedlpcctrlmmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs becaus...

7.8CVSS6.9AI score0.00358EPSS
Exploits0
Debian CVE
Debian CVE
•added 2021/10/04 8:20 p.m.•88 views

CVE-2021-41091

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby Docker Engine where the data directory typically /var/lib/docker contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traver...

6.3CVSS5.9AI score0.02693EPSS
Exploits3
Debian CVE
Debian CVE
•added 2021/05/19 8:0 p.m.•88 views

CVE-2021-29622

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirec...

6.5CVSS6.2AI score0.1956EPSS
Exploits0
Debian CVE
Debian CVE
•added 2021/04/28 6:15 p.m.•88 views

CVE-2021-29482

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size o...

7.5CVSS6.9AI score0.01438EPSS
Exploits0
Debian CVE
Debian CVE
•added 2021/02/24 12:0 a.m.•88 views

CVE-2021-27645

The nameserver caching daemon nscd in the GNU C Library aka glibc or libc6 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c...

2.5CVSS5.7AI score0.00374EPSS
Exploits0
Debian CVE
Debian CVE
•added 2021/02/14 3:43 a.m.•88 views

CVE-2021-26929

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 where the HordeTextFilter library before 2.3.7 is used. The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke us...

6.1CVSS6.2AI score0.04944EPSS
Exploits7
Debian CVE
Debian CVE
•added 2020/02/11 8:35 a.m.•88 views

CVE-2020-5529

Removed by vendor...

8.1CVSS6.8AI score0.04719EPSS
Exploits0
Debian CVE
Debian CVE
•added 2020/01/31 12:39 p.m.•88 views

CVE-2020-7219

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3...

7.5CVSS6.8AI score0.0201EPSS
Exploits0
Debian CVE
Debian CVE
•added 2020/01/09 10:27 p.m.•88 views

CVE-2019-20373

Removed by vendor...

7.8CVSS7.6AI score0.00427EPSS
Exploits0
Debian CVE
Debian CVE
•added 2019/11/05 6:50 p.m.•88 views

CVE-2013-6275

Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php...

6.5CVSS6.5AI score0.02072EPSS
Exploits6
Debian CVE
Debian CVE
•added 2019/10/30 9:46 p.m.•88 views

CVE-2018-21029

systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication SNI is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname...

9.8CVSS7.6AI score0.03138EPSS
Exploits1
Debian CVE
Debian CVE
•added 2019/06/05 4:27 a.m.•88 views

CVE-2019-12616

An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdmin database, and the attacker can potential...

6.5CVSS8AI score0.19184EPSS
Exploits4
Debian CVE
Debian CVE
•added 2018/04/18 7:0 p.m.•88 views

CVE-2018-1000164

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "processheaders" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been...

7.5CVSS7.6AI score0.02431EPSS
Exploits1
Total number of security vulnerabilities5000