Lucene search
+L
DebiancveMost viewed

61372 matches found

Debian CVE
Debian CVE
•added 2015/11/25 8:0 p.m.•89 views

CVE-2015-5306

OpenStack Ironic Inspector aka ironic-inspector or ironic-discoverd, when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error...

6.8CVSS7.2AI score0.01585EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2014/12/15 5:27 p.m.•89 views

CVE-2014-1569

The definitelengthdecoder function in lib/util/quickder.c in Mozilla Network Security Services NSS before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long...

7.5CVSS4.8AI score0.03182EPSS
SaveExploits4
Debian CVE
Debian CVE
•added 2013/02/24 9:0 p.m.•89 views

CVE-2013-0212

store/swift.py in OpenStack Glance Essex 2012.1, Folsom 2012.2 before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive...

4CVSS5.8AI score0.02965EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2006/08/30 1:0 a.m.•89 views

CVE-2006-4447

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit...

7.2CVSS6.4AI score0.00434EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2005/08/10 4:0 a.m.•89 views

CVE-2005-2536

Removed by vendor...

7.5CVSS6.7AI score0.02336EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/05/13 8:28 a.m.•88 views

CVE-2026-6276

Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom Host: header set, the second request would use stale information and pass on cookies meant for the first host in the second reques...

7.5CVSS5.8AI score0.00291EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2024/11/26 11:34 p.m.•88 views

CVE-2024-53849

editorconfig-core-c is theEditorConfig core library written in C for use by plugins supporting EditorConfig parsing. In affected versions several overflows may occur in switch case '' when the input pattern contains many escaped characters. The added backslashes leave too little space in the outp...

4.8CVSS5.2AI score0.00203EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2024/08/12 8:55 p.m.•88 views

CVE-2024-43360

ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder is affected by a time-based SQL Injection vulnerability. This vulnerability is fixed in 1.36.34 and 1.37.61...

9.8CVSS5.8AI score0.06222EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2024/07/01 6:15 p.m.•88 views

CVE-2024-38475

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...

9.1CVSS9.2AI score0.99957EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2024/04/23 8:23 p.m.•88 views

CVE-2024-32875

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The...

6.1CVSS6.1AI score0.00537EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2024/01/05 4:18 p.m.•88 views

CVE-2023-34322

For migration as well as to work around kernels unaware of L1TF see XSA-273, PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on th...

7.8CVSS5.2AI score0.0023EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2023/12/19 2:9 p.m.•88 views

CVE-2023-6931

A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perfevent's readsize can overflow, leading to an heap out-of-bounds increment or write in perfreadgroup. We recommend upgrading past commit...

7.8CVSS6.7AI score0.00715EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2023/11/30 9:17 p.m.•88 views

CVE-2023-49735

UNSUPPORTED WHEN ASSIGNED The value set as the DefaultLocaleResolver.LOCALEKEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to...

7.5CVSS7.5AI score0.01345EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2023/10/23 6:50 a.m.•88 views

CVE-2023-45802

When a HTTP/2 stream was reset RST frame by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing...

5.9CVSS6.6AI score0.03024EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2023/08/28 8:1 p.m.•88 views

CVE-2023-40170

jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which h...

6.1CVSS5.8AI score0.00542EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2023/08/22 12:0 a.m.•88 views

CVE-2022-37052

A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject...

6.5CVSS6AI score0.00902EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2023/07/26 12:0 a.m.•88 views

CVE-2023-38285

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity...

7.5CVSS7.5AI score0.00771EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2023/05/17 12:0 a.m.•88 views

CVE-2023-2203

A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of...

8.8CVSS8.6AI score0.00934EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2023/05/12 12:0 a.m.•88 views

CVE-2023-31916

Removed by vendor...

5.5CVSS5.5AI score0.00332EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2023/03/29 12:0 a.m.•88 views

CVE-2022-48434

libavcodec/pthreadframe.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances e.g., hardware re-initialization upon a mid-video SPS change when...

8.1CVSS7.1AI score0.01512EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2023/03/19 12:0 a.m.•88 views

CVE-2022-48423

In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur...

7.8CVSS7.7AI score0.00266EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2023/02/28 5:54 p.m.•88 views

CVE-2023-1018

An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM...

5.5CVSS6.6AI score0.05552EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2023/02/16 12:0 a.m.•88 views

CVE-2021-23980

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False Note: none of the above tags are in the default allowe...

6.1CVSS6.3AI score0.00483EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2023/01/30 12:0 a.m.•88 views

CVE-2022-48303

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in fromheader in list.c via a V7 archive in which mtime has approximately 11 whitespace...

5.5CVSS6.5AI score0.04524EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2022/12/14 12:0 a.m.•88 views

CVE-2022-3115

An issue was discovered in the Linux kernel through 5.16-rc6. malidpcrtcreset in drivers/gpu/drm/arm/malidpcrtc.c lacks check of the return value of kzalloc and will cause the null pointer dereference...

5.5CVSS6.8AI score0.00217EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2022/09/21 12:0 a.m.•88 views

CVE-2022-37026

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS...

9.8CVSS9.5AI score0.01211EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2022/09/16 9:40 p.m.•88 views

CVE-2022-35984

TensorFlow is an open source platform for machine learning. ParameterizedTruncatedNormal assumes shape is of type int32. A valid shape of type int64 results in a mismatched type CHECK fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit...

7.5CVSS6.8AI score0.00411EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2022/09/16 10:0 a.m.•88 views

CVE-2022-40152

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

7.5CVSS6AI score0.19653EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2022/09/08 10:8 p.m.•88 views

CVE-2019-25076

The TSS Tuple Space Search algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a denial of service delays of legitimate traffic via crafted packet data that requires excessive evaluation time within the packet classification algorithm for the MegaFlow cache, ak...

5.8CVSS5.8AI score0.01836EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2022/08/26 12:0 a.m.•88 views

CVE-2022-0216

A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsidomsgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU...

4.4CVSS5.9AI score0.00405EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2022/07/20 12:0 a.m.•88 views

CVE-2022-31160

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents...

6.1CVSS6.6AI score0.02475EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2022/07/14 2:51 p.m.•88 views

CVE-2022-32210

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via...

6.5CVSS6.4AI score0.0044EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2022/07/06 11:5 a.m.•88 views

CVE-2022-35230

An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...

5.4CVSS3.8AI score0.00714EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2022/05/17 12:0 a.m.•88 views

CVE-2022-28185

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an out-of-bounds write, which may lead to denial of service and data tampering...

7.1CVSS6.8AI score0.00302EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2022/04/05 12:25 a.m.•88 views

CVE-2022-0790

Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially perform a sandbox escape via a crafted HTML page...

9.6CVSS9.5AI score0.00918EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2022/03/23 7:46 p.m.•88 views

CVE-2021-4149

A vulnerability was found in btrfsalloctreeb in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service DOS due to a deadlock problem...

5.5CVSS6.2AI score0.004EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2022/03/16 2:4 p.m.•88 views

CVE-2021-39685

In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

7.8CVSS6.5AI score0.00461EPSS
SaveExploits2
Debian CVE
Debian CVE
•added 2022/03/16 2:3 p.m.•88 views

CVE-2021-39713

Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel...

7CVSS6.2AI score0.0021EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2022/03/10 2:50 p.m.•88 views

CVE-2021-33293

Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine in parser.c...

9.1CVSS9.2AI score0.02067EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2022/02/27 8:0 a.m.•88 views

CVE-2021-21708

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

9.8CVSS7.7AI score0.03002EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2022/02/22 12:0 a.m.•88 views

CVE-2022-25643

seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname...

9.8CVSS9.5AI score0.02108EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2022/02/18 2:50 p.m.•88 views

CVE-2022-23647

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted int...

7.5CVSS7AI score0.01479EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2022/02/09 10:4 p.m.•88 views

CVE-2021-0175

Removed by vendor...

6.5CVSS6AI score0.00515EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2022/02/04 10:32 p.m.•88 views

CVE-2022-23580

Tensorflow is an Open Source Machine Learning Framework. During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, a...

6.5CVSS7AI score0.00821EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2021/12/20 11:20 a.m.•88 views

CVE-2021-44224

A crafted URI sent to httpd configured as a forward proxy ProxyRequests on can cause a crash NULL pointer dereference or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint Server Side Request Forgery...

8.2CVSS7.2AI score0.82295EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/10/04 8:20 p.m.•88 views

CVE-2021-41091

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby Docker Engine where the data directory typically /var/lib/docker contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traver...

6.3CVSS5.9AI score0.02693EPSS
SaveExploits3
Debian CVE
Debian CVE
•added 2021/05/19 8:0 p.m.•88 views

CVE-2021-29622

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirec...

6.5CVSS6.2AI score0.1956EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/04/28 6:15 p.m.•88 views

CVE-2021-29482

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size o...

7.5CVSS6.9AI score0.01438EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/02/24 12:0 a.m.•88 views

CVE-2021-27645

The nameserver caching daemon nscd in the GNU C Library aka glibc or libc6 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c...

2.5CVSS5.7AI score0.00374EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/02/14 3:43 a.m.•88 views

CVE-2021-26929

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 where the HordeTextFilter library before 2.3.7 is used. The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke us...

6.1CVSS6.2AI score0.04944EPSS
SaveExploits7
Total number of security vulnerabilities5000