Lucene search
+L
DebiancveMost viewed

61459 matches found

Debian CVE
Debian CVE
•added 2020/09/11 12:0 a.m.•77 views

CVE-2020-14330

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

5.5CVSS6.9AI score0.00568EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2020/07/04 10:54 p.m.•77 views

CVE-2020-15523

In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading...

7.8CVSS6.6AI score0.00895EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/06/08 4:32 p.m.•77 views

CVE-2020-13696

An issue was discovered in LinuxTV xawtv before 3.107. The function devopen in v4l-conf.c does not perform sufficient checks to prevent an unprivileged caller of the program from opening unintended filesystem paths. This allows a local attacker with access to the v4l-conf setuid-root program to...

4.4CVSS3.7AI score0.00355EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/04/30 10:15 p.m.•77 views

CVE-2020-11028

In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release 5.3.3, 5.2.6, 5.1.5, 5.0.9,...

7.5CVSS3.7AI score0.02334EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/04/29 12:0 a.m.•77 views

CVE-2020-11023

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. This problem is patched in jQuery 3.5.0...

6.9CVSS6.8AI score0.8383EPSS
SaveExploits6
Debian CVE
Debian CVE
•added 2020/04/13 12:4 p.m.•77 views

CVE-2020-1759

A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the...

6.8CVSS6.8AI score0.01585EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/01/28 4:15 p.m.•77 views

CVE-2020-8086

The modauthldap and modauthldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the isadmin function. This grants remote entities admin-only functionality if their username matches the username of a local admin...

9.8CVSS9.3AI score0.01564EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/12/13 9:59 p.m.•77 views

CVE-2019-19796

Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file...

7.8CVSS3.7AI score0.00778EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2019/11/21 10:15 p.m.•77 views

CVE-2019-11325

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter...

9.8CVSS9.7AI score0.03354EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/11/12 2:23 p.m.•77 views

CVE-2019-18848

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string...

7.5CVSS7.5AI score0.01257EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/11/08 2:45 p.m.•77 views

CVE-2019-10222

A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients...

7.5CVSS7.6AI score0.0461EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/11/07 11:12 p.m.•77 views

CVE-2019-18835

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /sendjoin, /sendleave, and /invite may not be correctly signed, or may not come from the expected servers...

9.8CVSS8.7AI score0.00864EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/10/06 9:48 p.m.•77 views

CVE-2019-17266

libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soupntlmparsechallenge in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy...

9.8CVSS8.7AI score0.02784EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/09/26 2:7 p.m.•77 views

CVE-2019-10092

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with...

6.1CVSS5.9AI score0.81466EPSS
SaveExploits5
Debian CVE
Debian CVE
•added 2019/08/07 2:58 p.m.•77 views

CVE-2019-14745

In radare2 before 3.7.0, a command injection vulnerability exists in binsymbols in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in...

7.8CVSS7.9AI score0.04414EPSS
SaveExploits2
Debian CVE
Debian CVE
•added 2019/07/01 7:27 p.m.•77 views

CVE-2019-13137

ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadPSImage in coders/ps.c...

6.5CVSS6.4AI score0.01901EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2019/05/24 1:6 p.m.•77 views

CVE-2019-12312

In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKESAINIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKEAUTH exchange. This affects...

7.5CVSS5.5AI score0.02748EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2019/04/29 3:5 p.m.•77 views

CVE-2019-11597

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file...

8.1CVSS8AI score0.03708EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2019/04/05 4:1 a.m.•77 views

CVE-2019-10876

An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those...

6.5CVSS6.5AI score0.01757EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/04/04 3:25 p.m.•77 views

CVE-2018-20449

The hidmachanstats function in drivers/dma/qcom/hidmadbg.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by reading "callback=" lines in a debugfs file...

5.5CVSS4.9AI score0.00421EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/01/14 7:0 p.m.•77 views

CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

8.1CVSS7AI score0.04031EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/12/12 5:0 p.m.•77 views

CVE-2018-20103

An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the pointer point to itself, or create a long chain of valid pointers resulting in stack exhaustion...

7.5CVSS5.9AI score0.06593EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/12/08 4:0 a.m.•77 views

CVE-2018-19966

An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service host OS crash or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorre...

8.8CVSS5.6AI score0.00438EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/10/31 8:0 p.m.•77 views

CVE-2018-14661

It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to a format string attack. A remote, authenticated attacker could use this flaw to cause remote denial of service...

6.5CVSS7.3AI score0.02655EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/09/17 2:0 p.m.•77 views

CVE-2018-17143

Removed by vendor...

7.5CVSS6.8AI score0.02772EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2018/07/27 6:0 p.m.•77 views

CVE-2017-2621

An access-control flaw was found in the OpenStack Orchestration heat service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information...

5.9CVSS5.4AI score0.00413EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/07/10 2:0 p.m.•77 views

CVE-2018-1129

A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel ar...

6.5CVSS7.5AI score0.01902EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/04/19 2:0 p.m.•77 views

CVE-2018-10188

phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/dboperations.js, js/tbloperations.js, libraries/classes/Operations.php, and sql.php...

8.8CVSS9.1AI score0.04218EPSS
SaveExploits5
Debian CVE
Debian CVE
•added 2018/03/18 6:0 a.m.•77 views

CVE-2018-8768

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous...

7.8CVSS7.6AI score0.011EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/01/02 8:0 p.m.•77 views

CVE-2017-1000430

rust-base64 version = 0.5.1 is vulnerable to a buffer overflow when calculating the size of a buffer to use when encoding base64 using the 'encodeconfigbuf' and 'encodeconfig' functions...

9.8CVSS9.8AI score0.01534EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/09/20 11:0 p.m.•77 views

CVE-2017-14623

In the ldap.v2 aka go-ldap package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: 1 it relies only on the return error of the Bind function call to determine whether a user is...

8.1CVSS6.7AI score0.01669EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/05/18 6:13 a.m.•77 views

CVE-2017-9048

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more...

7.5CVSS8.4AI score0.04888EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2016/10/10 10:0 a.m.•77 views

CVE-2016-7117

Use-after-free vulnerability in the sysrecvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing...

10CVSS7.4AI score0.24299EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2016/08/31 2:0 p.m.•77 views

CVE-2016-7118

fs/fcntl.c in the "aufs 3.2.x+setfl-debian" patch in the linux-image package 3.2.0-4 kernel 3.2.81-1 in Debian wheezy mishandles FSETFL fcntl calls on directories, which allows local users to cause a denial of service NULL pointer dereference and system crash via standard filesystem operations, a...

5.5CVSS5.5AI score0.00368EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2015/11/16 9:0 p.m.•77 views

CVE-2015-8215

net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service packet loss via a value that is 1 smaller than the minimum compliant value or 2 larger than the MTU of a...

5CVSS6.6AI score0.03693EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2015/06/02 2:0 p.m.•77 views

CVE-2015-4050

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security...

4.3CVSS6.4AI score0.08269EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2015/05/19 6:0 p.m.•77 views

CVE-2015-3885

Integer overflow in the ljpegstart function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service crash via a crafted image, which triggers a buffer overflow, related to the len variable...

4.3CVSS6.8AI score0.05434EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2014/09/30 4:0 p.m.•77 views

CVE-2014-4330

The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service stack consumption and crash via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DDdump...

2.1CVSS7AI score0.00554EPSS
SaveExploits3
Debian CVE
Debian CVE
•added 2014/06/18 2:0 p.m.•77 views

CVE-2014-3876

Multiple cross-site scripting XSS vulnerabilities in Frams' Fast File EXchange FEX, aka fex before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the 1 akey parameter to rup or 2 disclaimer or 3 gm parameter to fuc...

4.3CVSS5.7AI score0.01914EPSS
SaveExploits3
Debian CVE
Debian CVE
•added 2014/06/02 3:0 p.m.•77 views

CVE-2013-6433

The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not properly set a configuration file for rootwrap, which allows remote attackers to gain privileges via a crafted configuration file...

7.6CVSS6.5AI score0.03324EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2014/04/07 12:0 a.m.•77 views

CVE-2014-0160

The 1 TLS and 2 DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys,...

7.5CVSS7.4AI score0.99999EPSS
SaveExploits90
Debian CVE
Debian CVE
•added 2014/02/02 12:0 a.m.•77 views

CVE-2013-6491

The python-qpid client common/rpc/implqpid.py in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpidprotocol is set to ssl, which allows remote attackers to obtain sensitive information by sniffing the network...

4.3CVSS5.9AI score0.01884EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2014/01/07 6:0 p.m.•77 views

CVE-2013-6480

Libcloud 0.12.3 through 0.13.2 does not set the scrubdata parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM...

2.1CVSS5.5AI score0.0206EPSS
SaveExploits2
Debian CVE
Debian CVE
•added 2013/03/14 8:0 p.m.•77 views

CVE-2013-2547

The cryptoreportone function in crypto/cryptouser.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAPNETADMI...

2.1CVSS5.5AI score0.00388EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2012/11/28 11:0 a.m.•77 views

CVE-2012-5370

JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service CPU consumption via crafted input to an application that maintains a hash table, as demonstrated by a universal...

5CVSS5.3AI score0.02249EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2011/01/10 7:18 p.m.•77 views

CVE-2010-4535

The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service resource consumption via a URL that...

5CVSS6.2AI score0.03348EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2009/04/16 3:0 p.m.•77 views

CVE-2009-1300

apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight...

10CVSS6.4AI score0.01856EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2009/01/30 7:0 p.m.•77 views

CVE-2009-0034

parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group aka %group in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command...

7.8CVSS6.4AI score0.00406EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2008/03/24 10:0 p.m.•77 views

CVE-2008-0073

Array index error in the sdpplinparse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitrary code via a large streamid SDP parameter...

6.8CVSS7.2AI score0.09171EPSS
SaveExploits7
Debian CVE
Debian CVE
•added 2004/09/17 4:0 a.m.•77 views

CVE-2004-0783

Stack-based buffer overflow in xpmextractcolor io-xpm.c in the XPM image decoder for gtk+ 2.4.4 gtk2 and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a certain color string. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in a...

7.5CVSS7.8AI score0.09434EPSS
SaveExploits0
Total number of security vulnerabilities5000