Lucene search
+L
DebiancveMost viewed

66301 matches found

Debian CVE
Debian CVE
•added 2022/03/10 3:48 a.m.•86 views

CVE-2022-26652

NATS nats-server before 2.7.4 allows Directory Traversal with write access via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected...

6.5CVSS6.5AI score0.02342EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2022/02/04 10:32 p.m.•86 views

CVE-2022-23590

Tensorflow is an Open Source Machine Learning Framework. A GraphDef from a TensorFlow SavedModel can be maliciously altered to cause a TensorFlow process to crash due to encountering a StatusOr value that is an error and forcibly extracting the value from it. We have patched the issue in multiple...

7.5CVSS7AI score0.00981EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2022/01/21 12:00 a.m.•86 views

CVE-2022-23837

In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users...

7.5CVSS7.4AI score0.05258EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2021/10/14 7:55 p.m.•86 views

CVE-2021-42340

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was...

7.5CVSS7.7AI score0.11796EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/09/17 12:00 a.m.•86 views

CVE-2021-3805

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

7.5CVSS7.6AI score0.02097EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2021/08/18 5:25 p.m.•86 views

CVE-2021-37617

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script when being installed to make sure there are no remnants of previous installations. In versions 3.0.3 through 3.2.4, the Client searches th...

7.3CVSS6.9AI score0.00474EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/08/08 7:21 p.m.•86 views

CVE-2021-38209

net/netfilter/nfconntrackstandalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NFSYSCTLCTMAX, NFSYSCTLCTEXPECTMAX, and NFSYSCTLCTBUCKETS sysctls...

3.3CVSS5.9AI score0.00283EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/08/07 6:58 p.m.•86 views

CVE-2021-38173

Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using sshfilterbtrbk.sh in authorizedkeys...

9.8CVSS9.8AI score0.03155EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/08/03 12:31 p.m.•86 views

CVE-2021-37833

A reflected cross-site scripting XSS vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands...

6.1CVSS6.1AI score0.04878EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2021/07/27 5:19 a.m.•86 views

CVE-2021-32558

An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur...

7.5CVSS7.3AI score0.0911EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2021/06/28 2:50 p.m.•86 views

CVE-2021-32718

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper tag sanitization, potentially allowing for JavaScript code execution in the...

5.4CVSS5.6AI score0.01432EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2021/06/24 1:15 p.m.•86 views

CVE-2021-29964

A locally-installed hostile program could send WMCOPYDATA messages that Firefox would process incorrectly, leading to an out-of-bounds read. This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability affects Thunderbird 78.11, Firefox 89, and Firefox ESR...

7.1CVSS8.1AI score0.00787EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/06/10 10:14 p.m.•86 views

CVE-2020-23321

Removed by vendor...

9.8CVSS9.4AI score0.01314EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2021/05/19 4:23 p.m.•86 views

CVE-2021-33204

In the pgpartman aka PG Partition Manager extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER functions because an explicit searchpath is not set...

9.8CVSS9.8AI score0.022EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/04/13 5:55 p.m.•86 views

CVE-2021-29428

In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreatin...

8.8CVSS8.2AI score0.00534EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2021/04/06 12:00 a.m.•86 views

CVE-2021-30151

Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used...

6.1CVSS6AI score0.04158EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2021/03/30 1:55 a.m.•86 views

CVE-2018-1110

A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service...

7.5CVSS7.3AI score0.0111EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/03/10 4:21 p.m.•86 views

CVE-2021-20205

Libjpeg-turbo versions 2.0.91 and 2.0.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted GIF image...

6.5CVSS6.2AI score0.01194EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/02/26 5:25 p.m.•86 views

CVE-2021-21273

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, requests to user provided domains were not restricted to external IP addresses when calculating the key...

6.1CVSS6.1AI score0.01809EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/02/18 3:35 a.m.•86 views

CVE-2021-27378

An issue was discovered in the randcore crate before 0.6.2 for Rust. Because readu32into and readu64into mishandle certain buffer-length checks, a random number generator may be seeded with too little data...

9.8CVSS9.4AI score0.01238EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/02/17 12:00 a.m.•86 views

CVE-2021-26931

An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests such as out of memory conditions, it isn'...

5.5CVSS6.4AI score0.00544EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/02/02 6:50 p.m.•86 views

CVE-2021-21289

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which...

8.3CVSS8.4AI score0.03507EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2021/01/25 4:33 p.m.•86 views

CVE-2021-3185

A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause the stack to be smashed, memory corruption and possibly code execution...

9.8CVSS10AI score0.02377EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/12/14 7:39 p.m.•86 views

CVE-2020-8285

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing...

7.5CVSS6.9AI score0.09655EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2020/12/04 12:00 a.m.•86 views

CVE-2020-27771

In RestoreMSCWarning of /coders/pdf.c there are several areas where calls to GetPixelIndex could result in values outside the range of representable for the unsigned char type. The patch casts the return value of GetPixelIndex to ssizet type to avoid this bug. This undefined behavior could be...

4.3CVSS5.9AI score0.01175EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2020/11/30 9:21 p.m.•86 views

CVE-2020-11867

Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files located there...

3.3CVSS4.4AI score0.00475EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/09/23 12:30 p.m.•86 views

CVE-2020-10687

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

5.8CVSS6.2AI score0.01147EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/09/16 12:00 a.m.•86 views

CVE-2020-10781

A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hotadd file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not accounted for a user...

5.5CVSS6.5AI score0.00311EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2020/07/28 9:12 p.m.•86 views

CVE-2020-6098

An exploitable denial of service vulnerability exists in the freeDiameter functionality of freeDiameter 1.3.2. A specially crafted Diameter request can trigger a memory corruption resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability...

7.5CVSS7.5AI score0.01763EPSS
SaveExploits2
Debian CVE
Debian CVE
•added 2020/07/09 2:45 p.m.•86 views

CVE-2020-12405

When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird 68.9.0, Firefox 77, and Firefox ESR 68.9...

5.3CVSS7.9AI score0.01352EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2020/04/13 12:04 p.m.•86 views

CVE-2020-1759

A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the...

6.8CVSS6.8AI score0.01625EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/12/11 1:33 a.m.•86 views

CVE-2019-19709

MediaWiki through 1.33.1 allows attackers to bypass the Titleblacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page...

6.1CVSS6.3AI score0.01564EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2019/12/04 3:10 p.m.•86 views

CVE-2014-8179

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation...

7.5CVSS7.4AI score0.02733EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/11/18 5:24 a.m.•86 views

CVE-2019-19066

A memory leak in the bfadimgetstats function in drivers/scsi/bfa/bfadattr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service memory consumption by triggering bfaportgetstats failures, aka CID-0e62395da2bd...

4.7CVSS6.8AI score0.00452EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/08/26 5:14 p.m.•86 views

CVE-2017-18589

An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic...

7.5CVSS7.5AI score0.01514EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/07/29 2:52 p.m.•86 views

CVE-2019-13103

A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data...

7.1CVSS8.2AI score0.0043EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2019/06/18 11:28 p.m.•86 views

CVE-2019-11038

When using the gdImageCreateFromXbm function in the GD Graphics Library aka LibGD 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value of uninitialized...

5.3CVSS5.4AI score0.04332EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2019/03/12 6:00 a.m.•86 views

CVE-2019-9721

A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handleopenbrace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf...

6.5CVSS6AI score0.01435EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/11/21 7:00 p.m.•86 views

CVE-2018-19416

An issue was discovered in sysstat 12.1.1. The remapstruct function in sacommon.c has an out-of-bounds read during a memmove call, as demonstrated by sadf...

7.8CVSS7.6AI score0.01715EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2018/09/28 12:00 a.m.•86 views

CVE-2018-17567

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "config.yml" file...

7.5CVSS7.4AI score0.02188EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/09/17 2:00 p.m.•86 views

CVE-2018-17143

Removed by vendor...

7.5CVSS6.8AI score0.02772EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2018/08/28 8:00 a.m.•86 views

CVE-2018-15919

Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration or...

5.3CVSS5.9AI score0.03557EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2018/06/07 2:00 a.m.•86 views

CVE-2017-16137

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...

5.3CVSS5.5AI score0.02798EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/08/10 10:00 p.m.•86 views

CVE-2016-6797

Removed by vendor...

7.5CVSS6.6AI score0.0807EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/02/15 3:00 p.m.•86 views

CVE-2015-8979

Stack-based buffer overflow in the parsePresentationContext function in storescp in DICOM dcmtk-3.6.0 and earlier allows remote attackers to cause a denial of service segmentation fault via a long string sent to TCP port 4242...

7.5CVSS7.5AI score0.03906EPSS
SaveExploits2
Debian CVE
Debian CVE
•added 2016/09/07 6:00 p.m.•86 views

CVE-2016-6346

RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors...

7.5CVSS7.5AI score0.05601EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2015/12/03 8:00 p.m.•86 views

CVE-2015-0860

Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which trigger...

7.5CVSS9.8AI score0.05035EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2014/10/02 2:00 p.m.•86 views

CVE-2014-3621

The catalog url replacement in OpenStack Identity Keystone before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$admintoken" in the publicurl endpoint field...

4CVSS5.8AI score0.02126EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2013/10/03 9:00 p.m.•86 views

CVE-2013-4327

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

6.9CVSS5.4AI score0.00301EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2012/09/25 11:00 p.m.•86 views

CVE-2012-0869

Cross-site scripting XSS vulnerability in fup in Frams' Fast File EXchange FEX, aka fex before 20120215 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

4.3CVSS5.5AI score0.04852EPSS
SaveExploits1
Total number of security vulnerabilities5000