Integer Overflow

The kernel-rt is vulnerable to Integer Overflow. A flaw was found in the Intel PRO/1000 network driver in the Linux kernel. Frames with sizes near the MTU of an interface may be split across multiple hardware receive descriptors. Receipt of such a frame could leak through a validation check,...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. The vulnerability exists as a web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox...

Arbitrary Code Execution

seamonkey is vulnerable to arbitrary code execution. The vulnerability exists as a web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey...

Arbitrary Code Execution

thunderbird is vulnerable to arbitrary code execution. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird...

Arbitrary Code Execution

firefox is vulnerable to arbitrary code execution. The vulnerability exists as a web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox...

Cross-Site Scripting (XSS)

seamonkey is vulnerable to cross-site scripting XSS. Several flaws were found in the display of malformed web content. A web page containing specially-crafted content could, potentially, trick a SeaMonkey user into surrendering sensitive information...

Arbitrary Code Execution

seamonkey is vulnerable to arbitrary code execution. The vulnerability exists as a webpage containing malicious content could cause SeaMonkey to crash, or potentially execute arbitrary code as the user running SeaMonkey...

Cross-site Scripting (XSS)

httpd is vulnerable to cross-site scripting XSS. The vulnerability exists as a flaw was found in the Apache HTTP Server modstatus module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Red Hat...

Arbitrary Code Execution

php is vulnerable to arbitrary code execution. A buffer over-read flaw was discovered in PHP's gd extension. A script that could be forced to write arbitrary strings using a JIS font from an untrusted source could cause the PHP interpreter to crash...

Denial Of Service (DoS)

ISC BIND Berkeley Internet Name Domain is vulnerable to Denial Of Service DoS. A use-after-free flaw was found in BIND. On servers that have recursion enabled, this could allow a remote attacker to cause a denial of service...

Denial Of Service (DoS)

imagemagick is vulnerable to denial of service DoS. The vulnerability exists through a heap-based buffer over-read in AdaptiveThresholdImage in MagickCore/threshold.c...

Remote Code Execution (RCE)

FasterXML jackson-databind is vulnerable to deserialization of untrusted data. There is a polymorphic typing issue because there are more than one association gadget types related to org.aoju.bus.proxy.provider.remoting.RmiProvider aka bus-proxy implementation by default...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists through a Count overflow in FUSE request leading to use-after-free issues...

Prototype Pollution

yargs-parser is vulnerable to prototype pollution. The attack exists as it does not properly sanitize the key value provided by users, allowing the malicious properties of Object.prototype to be parsed or modified using a proto payload...

HTTP Request Splitting

twisted is vulnerable to HTTP request splitting. The vulnerability exists as requests with both Content-Length and Transfer-Encoding headers would have honored the first header.This vulnerability is similar to CVE-2020-10108...

Remote Code Execution

chakracore is vulnerable to remote code execution RCE. This is due to how the scripting engine handles objects in memory, allowing a remote attacker to execute arbitrary code in the context of the current user. This CVE ID is different from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825,...

Deserialization Of Untrusted Object

jackson-databind is vulnerable to deserialization of untrusted data. It is possible because untrusted class org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig aka shaded hikari-config was not filtered by default from the interaction between serialization gadgets and polymorphic typing...

Use After Free (UAF)

github.com/proglottis/gpgme is vulnerable to use-after-free. The attack is possible because it allows malicious use for container image pulls by Docker or CRI-O, leading to an application crash or arbitrary code execution during GPG signature verification...

Denial Of Service (DoS)

wordpress is vulnerable to denial of service. The vulnerability exists in because an unauthenticated attacker is able to crash the application by submitting a large list of registered .js files to cause each file to be loaded multiple times, leading to excessive resource consumption...

Denial Of Service (DoS)

Mozilla firefox is vulnerable to denial of service DoS. The vulnerability exists through a buffer overflow issue in plain text serializer...

Information Disclosure

kernel is vulnerable to information disclosure. Due to the way Intel CPUs handle speculative execution of instructions when the TSX Asynchronous Abort TAA error occur, a local authenticated attacker with the ability to monitor execution times could infer the TSX memory state by comparing abort...

Unauthenticated Access To Restricted Resources

wordpress allows unauthenticated access to restricted resources. This vulnerability could allow unauthenticated users to view private or draft posts that would otherwise be restricted...

XML External Entity (XXE)

DiffPlug Spotless is vulnerable to XML external entities XXE. The XML formatter has resolveExternalURI setting to true by default and it loads external DTD...

Information Disclosure

undertow is vulnerable to information disclosure. The vulnerability exists as the DEBUG log for io.undertow.request.security leaks credentials to log files if it is enabled...

Denial Of Service (DoS)

sqlite3 is vulnerable to denial of service. A divide-by-zero bug in the whereLoopAddBtreeIndex function allows an attacker to crash the application...

Sandbox Restrictions Bypass

jenkins-plugin-script-security isv vulnerable to Sandbox bypass. This is possible through method pointer expressions in Script Security Plugin...

Information Disclosure

php is vulnerable to information disclosure. An uninitialized read in the function exifprocessIFDinMAKERNOTE due to mishandling of the datalen variable allows an attacker to read past allocated buffer and potentially obtain confidential information...

Arbitrary Code Execution

php is vulnerable to arbitrary code execution. A heap-based buffer over-read in the mbstring regular expression functions allows an attacker to execute arbitrary code on the system...

Denial Of Service (DoS)

Exiv2 is vulnerable to denial of service DoS. The Exiv2::DataValue::copy in value.cpp causes a null pointer dereference when a malicious input is provided, causing an application crash...

Denial Of Service (DoS)

openjdk is vulnerable to denial of service. It was discovered that the implementation of the Collections class in the Utilities component of OpenJDK did not limit the amount of memory allocated when creating object instance from a serialized form. A specially-crafted input could cause a Java...

OS Command Injection

vim is vulnerable to OS command injection. The :source! command in a modeline allows remote attackers to execute arbitrary OS commands...

Directory Traversal

pip is vulnerable to directory traversal. During installation of a remote package via pip install , a malicious server can send a Content-Disposition header containing ../ to join the temporary directory and the filename as download path, which allows for arbitrary file write and potentially code...

Cross-Site Request Forgery (CSRF)

phpMyAdmin is vulnerable to cross-site request forgery CSRF. The readCredentials function in AuthenticationCookie plugin uses $REQUEST instead of $POST. This allows an attacker to trick a user and deliver malicious payload, through statements such as INSERT or DELETE, to the victim...

Denial Of Service (DoS)

Python is vulnerable to denial of service attacks. Remote unauthenticated attackers could exploit the vulnerable Elementtree C Accelerator component by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and R...

Denial Of Service (DoS)

Oracle MySQL is vulnerable to denial of service attacks. A remote authenticated attacker could exploit a flaw in the Storage Engines component to cause denial of service conditions...

Information Disclosure

Linux kernel is vulnerable to information disclosure vulnerability. This is because Linux kernel does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhostnewmsg function. A privileged user could read some memory contents...

Privilege Escalation

Linux kernel is vulnerable to privilege escalation vulnerability. The vulnerability exists in an unknown function of the component Speculative Execution. An attacker could execute and/ read privileged memory by conducting targeted cache side-channel attacks...

Buffer Over-Read

PHP is vulnerable to buffer-over-read vulnerability. This occurs in the objectcommon1 function in ext/standard/varunserializer.c. Remote attackers could cause a denial of service via crafted serialized data that is mishandled in a finishnesteddata call...

Privilege Escalation

Linux kernel is vulnerable to privilege escalation vulnerability. This occurs in the 32-bit compatibility layer of the ioctl handling code of the v4l2 video driver in the Linux kernel. An attacker to overwrite a kernel memory from an unprivileged userspace process causing a privilege escalation...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service attacks. A local, authenticated attacker could exploit the flawed Keyring Handler component and create keyrings for other users via keyctl commands...

Privilege Escalation

Oracle MySQL is vulnerable to privilege escalation attacks. A remote, authenticated attacker could insert malicious input leading to the exploitation of the flawed Client programs component to gain elevated privileges. Successful attacks could result in unauthorized access to critical data or...

Information Disclosure

Linux kernel is vulnerable to information disclosure. The vulnerability exists because of incorrect error handling in the setmempolicy and mbind compat syscalls in 'mm/mempolicy.c' in the Linux kernel. Local users could obtain sensitive information from uninitialized stack data by triggering...

Path Traversal

Red Hat JBoss Enterprise Application is vulnerable to path traversal attacks. The attacks are possible because the application fails to sufficiently sanitize user-supplied input. Remote attackers may use a specially crafted request with directory-traversal sequences to read arbitrary files...

Denial Of Service (DoS)

rh-php56-php is vulnerable to denial of service. The vulnerability exists because the function exifprocessIFDTAG in ext/exif/exif.c allows an attacker to cause a denial of service...

Denial Of Service (DoS)

Wireshark, previously known as Ethereal, is a network protocol analyzer, which is used to capture and browse the traffic running on a computer network. Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or...

Insufficient Entropy In Key Generation Algorithm

The Network Time Protocol NTP is used to synchronize a computer's time with another referenced time source. It was found that because NTP's access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by...

Improper Input Validation

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 collection provide a stable release of Python 2.7 with a number of additional utilities and database connectors f...

Denial Of Service (DoS)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The php55 packages provide a recent stable release of PHP with the PEAR 1.9.4, memcache 3.0.8, and mongo 1.4.5 PECL extensions, and a number of additional utilities. The php55 packages have been upgraded to...

Denial Of Service (DoS)

imagemagick is vulnerable to denial of service DoS. The vulnerability exists in the DrawDashPolygon function of magick/render.c...

Denial Of Service (DoS)

MySQL Server is vulnerable to denial of service DoS attacks. The vulnerability exists as an unspecified vulnerability in Oracle MySQL .This allows a remote authenticated user to manipulate with an unknown input, causing the application to crash. The affected component is InnoDB...