Lucene search
+L
DebiancveMost viewed

66273 matches found

Debian CVE
Debian CVE
added 2017/09/17 7:00 p.m.91 views

CVE-2017-14505

DrawGetStrokeDashArray in wand/drawing-wand.c in ImageMagick 7.0.7-1 mishandles certain NULL arrays, which allows attackers to perform Denial of Service NULL pointer dereference and application crash in AcquireQuantumMemory within MagickCore/memory.c by providing a crafted Image File as input...

6.5CVSS7.3AI score0.01485EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2017/01/13 4:00 p.m.91 views

CVE-2016-7431

Removed by vendor...

5.3CVSS6.4AI score0.0871EPSS
SaveExploits1
Debian CVE
Debian CVE
added 2016/05/02 10:00 a.m.91 views

CVE-2016-3140

The digiportinit function in drivers/usb/serial/digiacceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service NULL pointer dereference and system crash via a crafted endpoints value in a USB device descriptor...

4.9CVSS6.3AI score0.0179EPSS
SaveExploits3
Debian CVE
Debian CVE
added 2016/01/20 4:00 p.m.91 views

CVE-2015-5295

The template-validate command in OpenStack Orchestration API Heat before 2015.1.3 kilo and 5.0.x before 5.0.1 liberty allows remote authenticated users to cause a denial of service memory consumption or determine the existence of local files via the resource type in a template, as demonstrated by...

5.5CVSS5.3AI score0.02928EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2014/04/23 2:00 p.m.91 views

CVE-2014-0472

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."...

5.1CVSS6.9AI score0.0565EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2014/02/27 1:00 a.m.91 views

CVE-2014-1263

curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a...

4.3CVSS6.1AI score0.02862EPSS
SaveExploits2
Debian CVE
Debian CVE
added 2014/02/20 11:00 a.m.91 views

CVE-2014-0080

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ backslash character...

6.8CVSS7.9AI score0.01266EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2013/11/23 7:00 p.m.91 views

CVE-2013-4509

The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen...

1.9CVSS6.4AI score0.00341EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2013/03/22 9:00 p.m.91 views

CVE-2013-0335

OpenStack Compute Nova Grizzly, Folsom 2012.2, and Essex 2012.1 allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port...

7.6CVSS6.3AI score0.02122EPSS
SaveExploits1
Debian CVE
Debian CVE
added 2013/02/13 1:00 a.m.91 views

CVE-2013-0276

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attrprotected protection mechanism and modify protected model attributes via a crafted request...

4.3CVSS6.2AI score0.0246EPSS
SaveExploits1
Debian CVE
Debian CVE
added 2011/10/10 10:00 a.m.91 views

CVE-2011-3599

The Crypt::DSA aka Crypt-DSA module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack...

5.8CVSS6.4AI score0.01958EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2010/06/14 6:00 p.m.91 views

CVE-2010-2263

nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI...

5CVSS6.7AI score0.71926EPSS
SaveExploits6
Debian CVE
Debian CVE
added 2010/01/13 8:00 p.m.91 views

CVE-2009-4487

nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

6.8CVSS7.5AI score0.29516EPSS
SaveExploits3
Debian CVE
Debian CVE
added 2009/06/06 6:00 p.m.91 views

CVE-2009-1959

Off-by-one error in the eventwallops function in fe-common/irc/fe-events.c in irssi 0.8.13 allows remote IRC servers to cause a denial of service crash via an empty command, which triggers a one-byte buffer under-read and a one-byte buffer underflow...

5CVSS6.2AI score0.08385EPSS
SaveExploits2
Debian CVE
Debian CVE
added 2006/03/03 11:00 a.m.91 views

CVE-2006-0987

The default configuration of ISC BIND before 9.4.1-P1, when configured as a caching name server, allows recursive queries and provides additional delegation information to arbitrary IP addresses, which allows remote attackers to cause a denial of service traffic amplification via DNS queries with...

5CVSS8.8AI score0.58033EPSS
SaveExploits2
Debian CVE
Debian CVE
added 2006/01/25 2:00 a.m.91 views

CVE-2006-0224

Buffer overflow in Library of Assorted Spiffy Things LibAST 0.6.1 and earlier, as used in Eterm and possibly other software, allows local users to execute arbitrary code as the utmp user via a long -X command line argument alternative configuration file name...

4.6CVSS7.3AI score0.00745EPSS
SaveExploits1
Debian CVE
Debian CVE
added 2005/08/30 4:00 a.m.91 views

CVE-2005-2654

phpldapadmin before 0.9.6c allows remote attackers to gain anonymous access to the LDAP server, even when disableanonbind is set, via an HTTP request to login.php with the anonymousbind parameter set...

7.5CVSS6.7AI score0.01776EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2005/08/10 4:00 a.m.91 views

CVE-2005-2536

Removed by vendor...

7.5CVSS6.7AI score0.02336EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2004/04/06 4:00 a.m.91 views

CVE-2004-0377

Buffer overflow in the win32stat function for 1 ActiveState's ActivePerl and 2 Larry Wall's Perl before 5.8.3 allows local or remote attackers to execute arbitrary commands via filenames that end in a backslash character...

10CVSS7.3AI score0.06766EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2026/05/07 6:30 p.m.90 views

CVE-2026-8084

A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit...

5.5CVSS5.4AI score0.00264EPSS
SaveExploits1
Debian CVE
Debian CVE
added 2025/09/17 2:56 p.m.90 views

CVE-2022-50371

In the Linux kernel, the following vulnerability has been resolved: led: qcom-lpg: Fix sleeping in atomic lpgbrighnessset function can sleep, while led's brightnessset callback must be non-blocking. Change LPG driver to use brightnesssetblocking instead. BUG: sleeping function called from invalid...

5.5CVSS5.4AI score0.00148EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2025/04/19 12:00 a.m.90 views

CVE-2023-26819

cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as "a": true, "b": null,9999999999999999999999999999999999999999999999912345678901234567...

2.9CVSS4.4AI score0.00223EPSS
SaveExploits1
Debian CVE
Debian CVE
added 2025/03/27 4:43 p.m.90 views

CVE-2023-53012

In the Linux kernel, the following vulnerability has been resolved: thermal: core: call putdevice only after deviceregister fails putdevice shouldn't be called before a prior call to deviceregister. thermalcoolingdeviceregister doesn't follow that properly and needs fixing. Also...

5.5CVSS5.4AI score0.00201EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2025/03/03 4:52 p.m.90 views

CVE-2025-27498

aes-gcm is a pure Rust implementation of the AES-GCM. In decryptinplacedetached, the decrypted ciphertext which is the correct ciphertext is exposed even if the tag is incorrect. This is because in decryptinplace in asconcore.rs, tag verification causes an error to be returned with the plaintext...

5.6CVSS5.3AI score0.00122EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2025/02/12 9:19 p.m.90 views

CVE-2023-43758

Improper input validation in UEFI firmware for some IntelR processors may allow a privileged user to potentially enable escalation of privilege via local access...

8.7CVSS7.7AI score0.00272EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2025/02/07 4:05 a.m.90 views

CVE-2025-1072

Removed by vendor...

6.5CVSS5.8AI score0.00537EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2024/11/21 12:00 a.m.90 views

CVE-2024-30896

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and...

9.1CVSS8.2AI score0.05356EPSS
SaveExploits3
Debian CVE
Debian CVE
added 2024/10/24 12:00 a.m.90 views

CVE-2024-48208

pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd function of the ls.c file...

8.6CVSS8.3AI score0.01562EPSS
SaveExploits1
Debian CVE
Debian CVE
added 2024/08/30 4:16 p.m.90 views

CVE-2024-8235

A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterface...

6.2CVSS6.1AI score0.00242EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2024/08/23 2:39 p.m.90 views

CVE-2024-43791

RequestStore provides per-request global storage for Rack. The files published as part of requeststore 1.3.2 have 0666 permissions, meaning that they are world-writable, which allows local users to execute arbitrary code. This version was published in 2017, and most production environments do not...

7.8CVSS7.9AI score0.00194EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2024/06/21 8:06 p.m.90 views

CVE-2020-27352

When generating the systemd service units for the docker snap and other similar snaps, snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading syst...

9.3CVSS7.3AI score0.00256EPSS
SaveExploits1
Debian CVE
Debian CVE
added 2024/05/21 3:30 p.m.90 views

CVE-2023-52761

In the Linux kernel, the following vulnerability has been resolved: riscv: VMAPSTACK overflow detection thread-safe commit 31da94c25aea "riscv: add VMAPSTACK overflow detection" added support for CONFIGVMAPSTACK. If overflow is detected, CPU switches to shadowstack temporarily before switching...

7.8CVSS4.6AI score0.00267EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2024/05/19 8:34 a.m.90 views

CVE-2024-35901

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix Rx DMA datasize and skboverpanic managetrxbufcfg aligns the RX buffer's DMA datasize to be multiple of 64. So a packet slightly bigger than mtu+14, say 1536, can be received and cause skboverpanic. Sample dmesg:...

7.5CVSS7.1AI score0.00472EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2024/04/29 3:49 a.m.90 views

CVE-2024-2757

In PHP 8.3. before 8.3.5, function mbencodemimeheader runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function...

7.5CVSS7.4AI score0.01924EPSS
SaveExploits1
Debian CVE
Debian CVE
added 2024/04/04 2:46 p.m.90 views

CVE-2024-28871

LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessive CPU usage. Version 0.5.47 contains a patch for the issue. No known workarounds are available...

7.5CVSS7.5AI score0.00841EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2024/04/03 5:00 p.m.90 views

CVE-2024-26732

In the Linux kernel, the following vulnerability has been resolved: net: implement lockless setsockoptSOPEEKOFF syzbot reported a lockdep violation 1 involving afunix support of SOPEEKOFF. Since SOPEEKOFF is inherently not thread safe it uses a per-socket skpeekoff field, there is really no point...

5.5CVSS5.4AI score0.00158EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2024/03/25 8:00 p.m.90 views

CVE-2024-28246

KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's trust option, specifically that provides a function to blacklist certain URL protocols, can be fooled by URLs in malicious inputs that use uppercase characters in the protocol. In particular, this can allow fo...

5.5CVSS5.4AI score0.00406EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2024/03/20 10:35 a.m.90 views

CVE-2023-46839

PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions need an IOMMU context...

5.3CVSS4.2AI score0.00805EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2024/03/06 6:28 p.m.90 views

CVE-2024-27289

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for ...

8.1CVSS7.1AI score0.00854EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2024/02/27 6:53 a.m.90 views

CVE-2021-46910

In the Linux kernel, the following vulnerability has been resolved: ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUGKMAPLOCAL is enabled The debugging code for kmaplocal doubles the number of per-CPU fixmap slots allocated for kmaplocal, in order to use half of them as guard regions. This...

7CVSS4.7AI score0.00197EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2023/12/19 2:09 p.m.90 views

CVE-2023-6931

A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perfevent's readsize can overflow, leading to an heap out-of-bounds increment or write in perfreadgroup. We recommend upgrading past commit...

7.8CVSS6AI score0.00715EPSS
SaveExploits1
Debian CVE
Debian CVE
added 2023/11/16 12:00 a.m.90 views

CVE-2023-48052

Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack...

7.4CVSS7.2AI score0.00307EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2023/11/02 6:56 p.m.90 views

CVE-2023-31022

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of service...

5.5CVSS5.2AI score0.00205EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2023/10/20 11:26 p.m.90 views

CVE-2023-45666

stbimage is a single file MIT licensed library for processing images. It may look like stbiloadgifmain doesn’t give guarantees about the content of output value delays upon failure. Although it sets delays to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a...

9.8CVSS9.5AI score0.00959EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2023/10/05 5:51 p.m.90 views

CVE-2023-44387

Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves them but applies the permissions of the symlink itself instead of the permissions of the linked file to the resulting file. This leads to...

6.5CVSS5.2AI score0.0021EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2023/09/20 5:00 a.m.90 views

CVE-2023-26144

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service DoS due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance. Note: It was not proven...

5.3CVSS5.6AI score0.01198EPSS
SaveExploits1
Debian CVE
Debian CVE
added 2023/08/30 5:32 p.m.90 views

CVE-2023-36811

borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository. The attack requires an...

4.7CVSS4.6AI score0.0011EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2023/08/22 12:00 a.m.90 views

CVE-2022-48545

An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02...

5.5CVSS6.8AI score0.00252EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2023/08/22 12:00 a.m.90 views

CVE-2020-18781

Heap buffer overflow vulnerability in FilePOSIX::read in File.cpp in audiofile 0.3.6 may cause denial-of-service via a crafted wav file, this bug can be triggered by the executable sfconvert...

5.5CVSS6.6AI score0.00287EPSS
SaveExploits1
Debian CVE
Debian CVE
added 2023/08/22 12:00 a.m.90 views

CVE-2020-21490

An issue was discovered in GNU Binutils 2.34. It is a memory leak when process microblaze-dis.c. This one will consume memory on each insn disassembled...

5.5CVSS5.5AI score0.00325EPSS
SaveExploits1
Total number of security vulnerabilities5000