Lucene search
+L
DebiancveMost viewed

61412 matches found

Debian CVE
Debian CVE
•added 2018/07/27 3:0 p.m.•67 views

CVE-2017-12165

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling...

7.5CVSS5.8AI score0.01858EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/07/27 1:0 p.m.•67 views

CVE-2017-2622

An accessibility flaw was found in the OpenStack Workflow mistral service where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information...

5.9CVSS5.4AI score0.00372EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/07/27 4:0 a.m.•67 views

CVE-2018-14613

An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in ioctlmappage when mounting and operating a crafted btrfs image, because of a lack of block group item validation in checkleafitem in fs/btrfs/tree-checker.c...

7.1CVSS6.5AI score0.02512EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2018/07/26 2:0 p.m.•67 views

CVE-2017-7539

An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device NBD server's initial connection negotiation, where the I/O coroutine was undefined. This could crash the qemu-nbd server if a client sent unexpected data during connection negotiation. A remote user or process...

7.5CVSS6.2AI score0.05529EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/07/10 2:0 p.m.•67 views

CVE-2018-10861

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected...

8.1CVSS7.8AI score0.03249EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/06/11 9:0 p.m.•67 views

CVE-2018-5152

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firef...

6.5CVSS8.3AI score0.01651EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/06/05 1:0 p.m.•67 views

CVE-2018-1000200

The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory OOM killing of large mlocked processes. The issue arises from an oom killed process's final thread calling exitmmap, which calls munlockvmapagesall for mlocked vmas.This can happen...

5.5CVSS6.6AI score0.00493EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/05/31 4:0 p.m.•67 views

CVE-2018-11625

In ImageMagick 7.0.7-37 Q16, SetGrayscaleImage in the quantize.c file allows attackers to cause a heap-based buffer over-read via a crafted file...

8.8CVSS8.4AI score0.02272EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2018/04/24 6:0 p.m.•67 views

CVE-2018-1059

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions...

6.1CVSS6.2AI score0.00878EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/03/26 3:0 p.m.•67 views

CVE-2017-15710

In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, modauthnzldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset...

7.5CVSS6.6AI score0.18197EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/03/26 3:0 p.m.•67 views

CVE-2018-1312

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed...

9.8CVSS6.3AI score0.15885EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/03/13 5:0 p.m.•67 views

CVE-2017-1002102

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running...

7.1CVSS6.3AI score0.0101EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/03/04 8:0 p.m.•67 views

CVE-2018-7567

In the Admin Package Manager in Open Ticket Request System OTRS 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server...

9CVSS7.6AI score0.05303EPSS
SaveExploits3
Debian CVE
Debian CVE
•added 2018/02/08 11:0 p.m.•67 views

CVE-2018-6789

An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely...

9.8CVSS9.3AI score0.82137EPSS
SaveExploits19
Debian CVE
Debian CVE
•added 2018/02/06 5:0 p.m.•67 views

CVE-2017-17663

The htpasswd implementation of minihttpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform code execution...

9.8CVSS9.9AI score0.02407EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/01/18 2:0 a.m.•67 views

CVE-2018-2618

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JCE. Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker wi...

5.9CVSS5.8AI score0.04721EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2018/01/10 3:0 p.m.•67 views

CVE-2017-7559

In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that als...

6.1CVSS6.3AI score0.01655EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/12/26 8:0 p.m.•67 views

CVE-2017-17914

In ImageMagick 7.0.7-16 Q16, a vulnerability was found in the function ReadOnePNGImage in coders/png.c, which allows attackers to cause a denial of service ReadOneMNGImage large loop via a crafted mng image file...

7.1CVSS7AI score0.0203EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/12/06 2:0 p.m.•67 views

CVE-2017-13156

An elevation of privilege vulnerability in the Android system art. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64211847...

7.8CVSS7.9AI score0.20089EPSS
SaveExploits9
Debian CVE
Debian CVE
•added 2017/11/20 1:0 a.m.•67 views

CVE-2017-16894

In Laravel framework through 5.5.21, remote attackers can obtain sensitive information such as externally usable passwords via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in...

7.5CVSS7.4AI score0.8703EPSS
SaveExploits4
Debian CVE
Debian CVE
•added 2017/11/04 1:0 a.m.•67 views

CVE-2017-16537

The imonprobe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a crafted USB device...

7.2CVSS7.5AI score0.00397EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/10/06 7:0 a.m.•67 views

CVE-2017-15056

plxelf.cpp in UPX 3.94 mishandles ELF headers, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted binary file, as demonstrated by an Invalid Pointer Read in PackLinuxElf64::unpack...

7.8CVSS8AI score0.00958EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/10/04 7:0 a.m.•67 views

CVE-2017-15023

readformattedentries in dwarf2.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted ELF file...

5.5CVSS6.1AI score0.02074EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/09/27 4:0 p.m.•67 views

CVE-2017-14775

Laravel before 5.5.10 mishandles the rememberme token verification process because DatabaseUserProvider does not have constant-time token comparison...

5.9CVSS5.7AI score0.01193EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/08/21 7:0 a.m.•67 views

CVE-2017-12982

The bmpreadinfoheader function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of service memory allocation failure in the opjimagecreate function in lib/openjp2/image.c, related to the opjalignedallocn...

5.5CVSS6AI score0.02858EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/07/25 11:0 p.m.•67 views

CVE-2017-11626

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite...

5.5CVSS5.4AI score0.01214EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2017/04/14 4:30 a.m.•67 views

CVE-2017-7862

FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decodeframe function in libavcodec/pictordec.c...

9.8CVSS9.8AI score0.02564EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/04/03 5:44 a.m.•67 views

CVE-2016-10218

The pdf14poptransparencygroup function in base/gdevp14.c in the PDF Transparency module in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted file...

5.5CVSS6.1AI score0.01273EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2017/03/20 4:0 p.m.•67 views

CVE-2017-5930

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...

3.5CVSS3.2AI score0.14953EPSS
SaveExploits2
Debian CVE
Debian CVE
•added 2017/02/24 4:23 a.m.•67 views

CVE-2017-6196

Multiple use-after-free vulnerabilities in the gximageenumbegin function in base/gxipixel.c in Ghostscript before ecceafe3abba2714ef9b432035fe0739d9b1a283 allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted PostScript...

7.8CVSS8.2AI score0.01809EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/02/06 5:0 p.m.•67 views

CVE-2016-7447

Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before 1.3.25 allows remote attackers to have unspecified impact via unknown vectors...

9.8CVSS10AI score0.04021EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2017/01/18 5:0 p.m.•67 views

CVE-2016-2233

Stack-based buffer overflow in the inboundcapls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service crash via a large number of options in a CAP LS message...

7.5CVSS7.5AI score0.34894EPSS
SaveExploits5
Debian CVE
Debian CVE
•added 2016/12/30 7:0 p.m.•67 views

CVE-2016-10074

The mail transport aka SwiftTransportMailTransport in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " backslash double quote in a crafted e-mail address in the 1 From, 2 ReturnPath, or 3 Sender...

9.8CVSS9.7AI score0.41827EPSS
SaveExploits18
Debian CVE
Debian CVE
•added 2016/10/03 9:0 p.m.•67 views

CVE-2016-7046

Red Hat JBoss Enterprise Application Platform EAP 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service CPU and disk consumption via a long URL...

7.1CVSS6.1AI score0.0248EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2016/09/11 10:0 a.m.•67 views

CVE-2016-7395

Removed by vendor...

8.8CVSS8.7AI score0.01088EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2016/08/07 10:0 a.m.•67 views

CVE-2016-5770

Removed by vendor...

9.8CVSS7.7AI score0.07337EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2016/07/04 10:0 p.m.•67 views

CVE-2016-3092

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service CPU consumption via a long boundary string...

7.8CVSS7.9AI score0.35927EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2016/05/16 10:0 a.m.•67 views

CVE-2015-4604

The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service application crash or possibly...

7.5CVSS8.5AI score0.0739EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2016/03/02 12:0 a.m.•67 views

CVE-2016-0703

The getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to...

5.9CVSS8.2AI score0.05398EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2015/10/27 4:0 p.m.•67 views

CVE-2015-5240

Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group...

3.5CVSS6.1AI score0.00963EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2015/06/25 4:0 p.m.•67 views

CVE-2015-1851

OpenStack Cinder before 2014.1.5 icehouse, 2014.2.x before 2014.2.4 juno, and 2015.1.x before 2015.1.1 kilo allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command...

6.8CVSS6AI score0.02618EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2015/06/02 2:0 p.m.•67 views

CVE-2015-3982

The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...

5CVSS6.3AI score0.01748EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2015/02/19 8:0 p.m.•67 views

CVE-2014-3578

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL...

5CVSS7.9AI score0.06215EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2014/11/03 11:0 p.m.•67 views

CVE-2014-0204

OpenStack Identity Keystone before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID...

6.5CVSS7.4AI score0.01386EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2014/10/31 3:0 p.m.•67 views

CVE-2014-3473

Cross-site scripting XSS vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject...

4.3CVSS5.4AI score0.01689EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2014/07/23 2:0 p.m.•67 views

CVE-2014-3555

OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service crash or long firewall rule updates by creating a large number of allowed address pairs...

4CVSS6AI score0.02209EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2014/07/06 11:0 p.m.•67 views

CVE-2014-4720

Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service CPU consumption via vectors related to "backtracking into the phrase," a different vulnerability than CVE-2014-0477...

5CVSS7.3AI score0.01864EPSS
SaveExploits1
Debian CVE
Debian CVE
•added 2014/07/03 1:0 a.m.•67 views

CVE-2014-4611

Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4uncompress function in lib/lz4/lz4decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service memory corruption o...

5CVSS7.2AI score0.08103EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2014/05/30 6:0 p.m.•67 views

CVE-2014-3864

Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of the intended directories via a crafted source package that lacks a --- header line...

6.4CVSS6.2AI score0.02825EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2014/04/30 2:0 p.m.•67 views

CVE-2014-0471

Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting."...

5CVSS6.4AI score0.02859EPSS
SaveExploits0
Total number of security vulnerabilities5000