Denial Of Service (DoS)

Artifex Software GhostScript is vulnerable to denial of service attacks. A remote attacker could cause buffer overflows in mjcolorcorrect in contrib/japanese/gdevmjc.c via a crafted PDF file resulting in denial of service conditions...

Remote Code Execution (RCE)

Dropbear is vulnerable to remote code execution. The vulnerability existed because of a double free in cleanup of TCP listeners when the -a option is enabled...

Arbitrary Code Execution

libapache2-mod-fcgid is vulnerable to arbitrary code execution. A heap-based buffer overflow in the fcgidheaderbucketread function in fcgidbucket.c allows remote attackers to execute arbitrary code on the host OS...

Remote Code Execution (RCE)

Google Chrome is vulnerable to remote code execution. The vulnerability existed because of an integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux. An attacker is able to execute arbitrary code via a crafted HTML page...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS. The vulnerability exists through the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3...

Denial Of Service (DoS)

oniguruma is vulnerable to denial of service DoS. The vulnerability exists through a heap-based buffer overflow in strlowercasematch in regexec.c...

Information Disclosure

php is vulnerable to information disclosure. The vulnerability exists as the DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte...

Denial Of Service (DoS)

mysql is vulnerable to denial of service DoS. An attacker having high privilege with network access via multiple protocols can compromise MySQL Server...

Overwriting Variables

postgresql is vulnerable to overwriting variables. The vulnerability exists because \gset allows overwriting specially treated variables...

PHAR Unserialization

pear/archivetar is vulnerable to PHAR unserialization. The vulnerability exists due to the improper validation of filename that allows a filename that starts with PHAR:// to be executed...

Open Redirection

werkzeug is vulnerable to open redirection. An attacker is able to redirect a user to a malicious site via double slashes in the URL...

Arbitrary Code Execution

chakracore is vulnerable to arbitrary code execution. A memory corruption vulnerability allows an attacker to execute arbitrary code on the host OS. This CVE ID is different from CVE-2020-17048...

Information Disclosure

kernel is vulnerable to information disclosure.It incorrectly writes to the /proc/sys/vm/cmmtimeout file.This flaw allows to local user see the kernel stack information leak on s390/s390x...

Denial Of Service (DoS)

kernel is vulnerable to denial-of-service DoS attacks. The vulnerability exists in dlparparseccproperty in arch/powerpc/platforms/pseries/dlpar.c due to an unchecked kstrdup of prop-name allowing an attacker to cause an application crash...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. A use-after-free in nttyreceivebufcommon allows an attacker to crash the kernel and potentially obtain confidential information...

Cross-Site Request Forgery (CSRF)

wordpress is vulnerable to cross-site request forgery CSRF. Lack of authenticity check for HTTP requests allows an attacker to submit requests on behalf of a user, such as changing of the theme's background image...

Information Disclosure

guava is vulnerable to Information Disclosure. A folder with insecure permissions is created by the function com.google.common.io.Files.createTempDir. A local user will be able to steal secrets stored in this directory...

Information Disclosure

kernel is vulnerable to information disclosure. The vulnerability exists in net bluetooth when processing certain AMP packets...

Information Disclosure

apache tomcat is vulnerable to information disclosure. The HTTP headers within a request can potentially be included in a subsequent request and reveal confidential information, when the agreed maximum number of concurrent streams for a connection is exceeded...

Cross-site Scripting (XSS)

phpmyadmin is vulnerable to cross-site scripting XSS. Failure to validate the requestparams whereclause allows an attacker inject and execute arbitrary Javascript in a user's browser by sending a link to the victim containing the malicious JavaScript via the transformation feature...

XML External Entity (XXE) Injection

print-lib/print-servlet is vulnerable to XML External Entity XXE injection. A remote attacker is able to inject untrusted XML entity via tryLoadSLD as SDL parser does not disable DTDs...

Privilege Escalation

Qt is vulnerable to Privilege Escalation. Files placed by attacker can influence the working directory and lead to malicious code execution...

Arbitrary Code Execution

kernel is vulnerable to arbitrary code execution. The vulnerability exists through a use after free caused by a race condition in smptasktimedout and smptaskdone in drivers/scsi/libsas/sasexpander.c which allows an attacker to execute arbitrary codes...

Cross-site Scripting (XSS)

firefox is vulnerable to cross-site scripting XSS. The vulnerability exists when pasting a tag from the clipboard into a rich text editor, and the CSS sanitizer does not escape characters, and when a webpage subsequently copies the node's innerHTML, and assigns it to another innerHTML...

Wrong Access Permission

Linux kernel is using wrong access permission.It can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered...

Injection Attacks

thunderbird is vulnerable to injection attacks. The vulnerability exists as the CSS sanitizer incorrectly rewrites a @namespace rule when pasting a tag from the clipboard into a rich text editor...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. The ifsdio.c module does not validate the allocworkqueue return value, resulting in a NULL pointer dereference causing a crash...

Arbitrary Code Execution

ruby is vulnerable to arbitrary code execution. An attacker is able to inject code in the first argument to the command argument to Shell or Shelltest in lib/shell.rb...

Spoofable Frames

linux is vulnerable to spoofable network frames. The vulnerability exists through the reinstallation of the Integrity Group Temporal Key IGTK during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients...

Use-after-free

Linux kernel has a use-after-free bug that can be caused by a malicious USB device in the drivers/usb/misc/iowarrior.c driver, aka CID-edc4746f253d...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service DoS. There is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c...

XML External Entity (XXE)

mpxj is vulnerable to XML external entity attacks. The XMLFilter is configured with external DTDs by default, allowing an attacker to perform XXE attacks to access system files or perform requests on behalf of the server...

Arbitrary Code Execution

Webkit2gtk is vulnerable to arbitrary code execution. The vulnerability exists as a use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content...

Denial Of Service (DoS)

xen is vulnerable to denial of service DoS. The vulnerability exists through the bad continuation handling in GNTTABOPcopy. Grant table operations are expected to return 0 for success, and a negative number for errors. The fix for CVE-2017-12135 introduced a path through grant copy handling where...

Arbitrary Code Execution

webkit2gtk is vulnerable to arbitrary code execution. The vulnerability exists as a logic issue was addressed with improved restrictions...

Authorization Bypass

openjdk is vulnerable to authorizatino bypass. XML validation manipulation due to incomplete application of the use-grammar-pool-only feature allows an attacker to perform unauthorized update, insert and delete operations...

Information Disclosure

openjdk is vulnerable to information disclosure. HostnameChecker does not ensure X.509 certificate names are in normalized form, potentially resulting in an unauthorized read access...

Denial Of Service (DoS)

unbound is vulnerable to denial of service DoS. The vulnerability exists due to an incomplete fix for CVE-2020-12662 in RHEL7...

Denial Of Service (DoS)

unbound is vulnerable to Denial of Service DoS. The attack exists because of amplification of an incoming query into a large number of queries directed to a target...

Arbitrary Code Execution

commons-configuration2 is vulnerable to arbitrary code execution. The package uses a third-party library that, by default, allows the instantiation of arbitrary classes to parse if the YAML contains special statements. This allows an attacker to execute arbitrary code on the host application if t...

Denial Of Service (DoS)

perl is vulnerable to denial of service DoS. The vulnerability exists as buffer overflow in the SgrokbslashN function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service application crash via ...

Privilege Escalation

subversion is vulnerable to privilege escalation. The vulnerability exists as a maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicio...

Arbitrary Code Execution

openjpeg is vulnerable to arbitrary code execution. A heap-based buffer overflow was discovered in the opjt2encodepacket function in lib/openjp2/t2.c which may lead to remote denial of service or potentially allow an attacker to execute arbitrary code on the system...

Buffer Overflows

Mozilla is vulnerable to a Buffer overflow in SCTP chunk input validation...

Privilege Escalation

gvfs is vulnerable to privilege escalation. A race condition in daemon/gvfsbackendadmin.c allows escalation of privileges due to admin backend not implementing queryinfoonread/write...

Missing HTTP Security Headers

keycloak does not contain security headers in its server responses. The lack of these headers does not directly lead to a vulnerability, however it reduces the restrictions of an attacker and aids them in their efforts in the event of a successful exploit of a web vulnerability...

Arbitrary Code Execution

rpm is vulnerable to arbitrary code execution. An attacker could create a specially-crafted RPM package that, when its package header was accessed, or during package signature verification, could cause an application using the RPM library such as the rpm command line tool, or the yum and up2date...

Denial Of Service (DoS)

glibc is vulnerable to denial of service. A denial of service flaw was found in the remote procedure call RPC implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that...

Arbitrary Code Execution

openssl is vulnerable to arbitrary code execution. The vulnerability exists as a double free flaw was discovered in the policy checking code in OpenSSL. A remote attacker could use this flaw to crash an application that uses OpenSSL by providing an X.509 certificate that has specially-crafted...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists as a flaw was found in the way the Linux kernel handled fragmented IPv6 UDP datagrams over the bridge with UDP Fragmentation Offload UFO functionality on. A remote attacker could use this flaw to cause a denial of service...