Lucene search
+L
DebiancveMost viewed

66291 matches found

Debian CVE
Debian CVE
•added 2021/08/25 6:31 p.m.•87 views

CVE-2021-22245

Removed by vendor...

4CVSS5.8AI score0.01366EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/08/05 12:00 a.m.•87 views

CVE-2021-22925

curl supports the -t command line option, known as CURLOPTTELNETOPTIONSin libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending NEWENV variables, libcurlcould be made to pass on uninitialized data from a stack based...

5.3CVSS7AI score0.04929EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2021/07/19 12:00 a.m.•87 views

CVE-2020-36423

An issue was discovered in Arm Mbed TLS before 2.23.0. A remote attacker can recover plaintext because a certain Lucky 13 countermeasure doesn't properly consider the case of a hardware accelerator...

7.5CVSS7.4AI score0.01195EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/07/07 12:57 a.m.•87 views

CVE-2021-35039

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIGMODULESIG, verification that a kernel module is signed, for loading via initmodule, does not occur for a module.sigenforce=1 command-line argument...

7.8CVSS5.5AI score0.00246EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/06/23 11:40 p.m.•87 views

CVE-2021-32823

In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit. In combination with...

4.3CVSS3.8AI score0.01866EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2021/05/05 3:06 p.m.•87 views

CVE-2021-32055

Mutt 1.11.0 through 2.0.x before 2.0.7 and NeoMutt 2019-10-25 through 2021-05-04 has a $imapqresync issue in which imap/util.c has an out-of-bounds read in situations where an IMAP sequence set ends with a comma. NOTE: the $imapqresync setting for QRESYNC is not enabled by default...

9.1CVSS9.2AI score0.02551EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/04/12 9:30 p.m.•87 views

CVE-2021-29429

In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded...

5.5CVSS7.1AI score0.00484EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2021/04/06 11:29 p.m.•87 views

CVE-2020-36310

An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a setmemoryregiontest infinite loop for certain nested page faults, aka CID-e72436bc3a52...

5.5CVSS6.6AI score0.00329EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/02/16 4:55 p.m.•87 views

CVE-2021-23840

Calls to EVPCipherUpdate, EVPEncryptUpdate and EVPDecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 indicating succes...

7.5CVSS7AI score0.50732EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/12/31 8:21 a.m.•87 views

CVE-2020-35904

An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust. It has incorrect expectations about the relationship between the memory allocation and how many iterator elements there are...

5.5CVSS5.8AI score0.00388EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2020/09/23 1:53 p.m.•87 views

CVE-2020-25739

An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escapemode parameter to escape fields as an XSS protection mechanism. To mitigate, jsondumper.rb in gon now does escaping for XSS by default without relying on MultiJson...

6.1CVSS6.3AI score0.01376EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/09/16 3:55 p.m.•87 views

CVE-2014-10402

An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the fdir attribute in the data source name DSN. NOTE: this issue exists because of an incomplete fix for CVE-2014-10401...

6.1CVSS6.8AI score0.00484EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2020/08/31 11:15 p.m.•87 views

CVE-2020-15704

The modprobe child process in the ./debian/patches/loadpppgenericifneeded patch file incorrectly handled module loading. A local non-root attacker could exploit the MODPROBEOPTIONS environment variable to read arbitrary root files. Fixed in 2.4.5-5ubuntu1.4, 2.4.5-5.1ubuntu2.3+esm2,...

5.5CVSS5.3AI score0.00364EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/06/15 2:33 p.m.•87 views

CVE-2017-18869

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks...

2.5CVSS5.5AI score0.00336EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2020/06/05 1:27 p.m.•87 views

CVE-2020-10878

Perl before 5.30.3 has an integer overflow related to mishandling of a "PLregkindOPn == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection...

8.6CVSS8AI score0.04879EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/05/24 9:55 p.m.•87 views

CVE-2020-13434

SQLite through 3.32.0 has an integer overflow in sqlite3strvappendf in printf.c...

5.5CVSS7.3AI score0.01013EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2020/05/06 11:43 p.m.•87 views

CVE-2020-12689

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope trust/oauth/application credential can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially...

8.8CVSS8.6AI score0.01562EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/05/05 4:23 a.m.•87 views

CVE-2020-12652

The mptctlioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect lock during the ioctl operation and trigger a race condition, i.e., a "double fetch" vulnerability, aka CID-28d76df18f0a. NOTE: the vendor states "The security...

4.7CVSS6.6AI score0.00328EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/04/30 10:15 p.m.•87 views

CVE-2020-11028

In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release 5.3.3, 5.2.6, 5.1.5, 5.0.9,...

7.5CVSS3.7AI score0.02334EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/04/27 12:00 a.m.•87 views

CVE-2020-12272

OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the...

5.3CVSS5.7AI score0.02136EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2020/01/09 2:41 p.m.•87 views

CVE-2019-19332

An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVMGETEMULATEDCPUID' ioctl2 request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device...

6.1CVSS7.3AI score0.00679EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2019/12/20 11:00 p.m.•87 views

CVE-2019-16785

Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end serve...

7.5CVSS6.5AI score0.02537EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2019/11/21 10:15 p.m.•87 views

CVE-2019-11325

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter...

9.8CVSS9.7AI score0.03354EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/10/17 7:17 p.m.•87 views

CVE-2019-6475

Mirror zones are a BIND feature allowing recursive servers to pre-cache zone data provided by other servers. A mirror zone is similar to a zone of type secondary, except that its data is subject to DNSSEC validation before being used in answers, as if it had been looked up via traditional...

7.5CVSS6.5AI score0.01273EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/10/04 4:57 p.m.•87 views

CVE-2019-17178

HuffmanTreemakeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplied realloc pointer i.e., the first argument to realloc is also used for a realloc return value...

7.5CVSS7.4AI score0.02579EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/05/06 4:48 p.m.•87 views

CVE-2019-5432

A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding...

7.5CVSS7.4AI score0.01586EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2019/01/14 7:00 p.m.•87 views

CVE-2018-16886

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

8.1CVSS7AI score0.04031EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/09/18 5:00 p.m.•87 views

CVE-2018-17175

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields if the schema is being filtered dynamically using the...

5.3CVSS5.3AI score0.01858EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/04/18 7:00 p.m.•87 views

CVE-2018-1000161

nmap version 6.49BETA6 through 7.60, up to and including SVN revision 37147 contains a Directory Traversal vulnerability in NSE script http-fetch that can result in file overwrite as the user is running it. This attack appears to be exploitable via a victim that runs NSE script http-fetch against...

5.7CVSS5.6AI score0.01045EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/03/28 5:00 p.m.•87 views

CVE-2017-11509

An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement...

9CVSS8.9AI score0.06184EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2018/03/01 8:00 p.m.•87 views

CVE-2017-18211

In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/opencl.c because a program-lookup result is not checked, related to CacheOpenCLKernel...

9.8CVSS7.8AI score0.03892EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/02/23 11:00 p.m.•87 views

CVE-2018-1305

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that...

6.5CVSS7.1AI score0.14472EPSS
SaveExploits2
Debian CVE
Debian CVE
•added 2017/12/26 8:00 p.m.•87 views

CVE-2017-17914

In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of service ReadOneMNGImage large loop via a crafted mng image file...

7.1CVSS7AI score0.0203EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/10/24 6:00 p.m.•87 views

CVE-2016-10517

networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol but commonly occur when an attack triggers an HTTP request to the Redis TCP port...

7.4CVSS7.5AI score0.02147EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/09/29 8:00 p.m.•87 views

CVE-2016-4434

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity XXE attacks via vectors involving 1 spreadsheets in OOXML files and 2 XMP metadata in PDF and other file formats, a related issue to...

7.8CVSS7.8AI score0.0359EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/03/15 3:00 p.m.•87 views

CVE-2017-6429

Buffer overflow in the tcpcapinfo utility in Tcpreplay before 4.2.0 Beta 1 allows remote attackers to have unspecified impact via a pcap file with an over-size packet...

7.8CVSS8.1AI score0.02501EPSS
SaveExploits2
Debian CVE
Debian CVE
•added 2017/02/23 5:00 p.m.•87 views

CVE-2017-6214

The tcpspliceread function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers to cause a denial of service infinite loop and soft lockup via vectors involving a TCP packet with the URG flag...

7.5CVSS7.6AI score0.04666EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2016/10/25 2:00 p.m.•87 views

CVE-2016-5537

Unspecified vulnerability in the NetBeans component in Oracle Fusion Middleware 8.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information is from the October 2016 CPU. Oracle has not commented on third-party claims that this...

5.7CVSS5.7AI score0.01038EPSS
SaveExploits5
Debian CVE
Debian CVE
•added 2014/10/31 3:00 p.m.•87 views

CVE-2014-3474

Cross-site scripting XSS vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a networ...

3.5CVSS5.1AI score0.01933EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2014/08/20 10:00 a.m.•87 views

CVE-2014-3514

activerecord/lib/activerecord/relation/querymethods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes createwith calls...

7.5CVSS6.4AI score0.02797EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2014/02/03 2:00 a.m.•87 views

CVE-2013-4739

The MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allows attackers to obtain sensitive information from kernel stack memory via 1 a crafted MSMMCRIOCTLEVTGET ioctl call, related to...

4.9CVSS5.8AI score0.00252EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2013/03/12 4:00 p.m.•87 views

CVE-2013-1049

Buffer overflow in the RFC1413 ident client in cfingerd 1.4.3-3 allows remote IDENT servers to cause a denial of service crash and possibly execute arbitrary code via a crafted response...

10CVSS7.6AI score0.03125EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2012/11/11 11:00 a.m.•87 views

CVE-2012-5482

The v2 API in OpenStack Glance Grizzly, Folsom 2012.2, and Essex 2012.1 allows remote authenticated users to delete arbitrary non-protected images via an image deletion request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4573...

5.5CVSS6.4AI score0.02745EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2012/08/21 11:00 p.m.•87 views

CVE-2012-4345

Multiple cross-site scripting XSS vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via 1 a crafted table name during table creation, or a 2 Empty link or 3 Drop link...

3.5CVSS5.4AI score0.01449EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2012/06/17 1:00 a.m.•87 views

CVE-2012-2091

Multiple buffer overflows in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service crash and possibly execute arbitrary code via a 1 long string in a rotor tag of an aircraft xml model to the Rotor::getValueforFGSet function in...

9.3CVSS7.6AI score0.06463EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2012/05/27 8:00 p.m.•87 views

CVE-2012-2942

Buffer overflow in the trash buffer in the header capture functionality in HAProxy before 1.4.21, when global.tune.bufsize is set to a value greater than the default and header rewriting is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via...

5.1CVSS7.7AI score0.05413EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2011/04/11 6:00 p.m.•87 views

CVE-2009-5065

Cross-site scripting XSS vulnerability in feedparser.py in Universal Feed Parser aka feedparser or python-feedparser before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas...

4.3CVSS5.4AI score0.0453EPSS
SaveExploits2
Debian CVE
Debian CVE
•added 2009/12/23 6:00 p.m.•87 views

CVE-2009-3581

Multiple cross-site scripting XSS vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via 1 the DCN Description field in the Accounts Receivables menu item for Add Transaction, 2 the Description field in the Accounts Payable menu item for A...

3.5CVSS2.2AI score0.00861EPSS
SaveExploits2
Debian CVE
Debian CVE
•added 2009/01/28 11:00 a.m.•87 views

CVE-2009-0314

Untrusted search path vulnerability in the Python module in gedit allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySysSetArgv function CVE-2008-5983...

6.9CVSS9.1AI score0.00624EPSS
SaveExploits2
Debian CVE
Debian CVE
•added 2007/06/07 9:00 p.m.•87 views

CVE-2007-3112

graphimage.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service CPU consumption via a large value of the 1 graphstart or 2 graphend parameter, different vectors than CVE-2007-3113...

7.8CVSS6AI score0.02406EPSS
SaveExploits1
Total number of security vulnerabilities5000