Authorization Bypass

moodle/moodle is vulnerable to authorization bypass. When creating a user account, it was possible to verify the account without having access to the verification email link/secret...

Information Disclosure

ceph is vulnerable to information disclosure. The vulnerability exists due to the password stored in mgr logs for gradana and dashboard...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service DoS. It is possible because of a NULL-ptr deref in the spkttyioreceivebuf2 function in spkttyio.c...

Arbitrary Code Execution

linux is vulnerable to arbitrary code execution. The vulnerabilitye exists as the kernel PV block backend expects the kernel thread handler to reset ring-xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and...

XML External Entity (XXE)

batik-svgbrowser is vulnerable to XML external entity attacks. An attacker is able to submit HTTP GET requests on behalf of the server using malicious arguments...

Privilege Escalation

Qemu is vulnerable to privilege escalation attack. A race condition flaw was found in the 9pfs server implementation of QEMU. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability i...

Denial Of Service (DoS)

glibc is vulnerable to denial of service DoS. The vulnerability exists through sysdeps/i386/ldbl2mpn.c where a stack-based buffer overflow occurs on the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a...

Privlege Escalation

kernel is vulnerable to privilege escalation. A local attacker is able to abuse this flaw to bypass checks to abuse the insecure child/parent process identification handling while filtering signal handlers, and send any signal to a privileged process...

Arbitrary Code Execution

github.com/golang/go is vulnerable to arbitrary code execution. The go command may execute arbitrary code at build time when users have “.” listed explicitly in their PATH and are running “go get” or build commands outside of a module or with module mode disabled...

Privilege Escalation

xen is vulnerable to privilege escalation. The vulnerability exists through a data leak caused by an AMD IOMMU page-table entry that can be half-updated...

Regular Expression Denial Of Service (ReDoS)

jquery-validation is vulnerable to regular expression denial of service. An insecure use of a regular expression to parse URLs allows an attacker to cause a denial of service condition via a malicious URL...

Arbitrary Code Execution

jackson-databind is vulnerable to remote code execution RCE. The vulnerability exists through the lack of sanitization of the "org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource class through deserialization...

XML External Entity (XXE)

plonesupermodel is vulnerable to XML external entity XXE attacks. The vulnerability exists due to an unapplied permission which would allow an attacker with Manager role to perform XXE attacks and submit requests on behalf of the server and access restricted internal or local resources...

Denial Of Service (DoS)

open-iscsi is vulnerable to denial of service DoS. The vulnerability exists through an Out-of-Bounds read in the uIP TCP/IP Stack component when calculating the checksums for IP packets in upperlayerchksum in net/ipv4/uip.c...

Arbitrary Code Execution

openjpeg is vulnerable to arbitrary code execution. A heap-based buffer-overflow write allows an attacker to execute arbitrary code on the host OS...

Use After Free

chromium, sid is vulnerable to Use after free in printing in Google Chrome. It allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...

Denial Of Service(DoS)

chromium, sid is vulnerable to Denial of ServiceDoS. Inappropriate implementation in V8 in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Denial Of Service (DoS)

QEMU is vulnerable to denial of service. This vulnerability exist because of a flaw in the memory management API during the initialization of a memory region cache...

Denial Of Service (DoS)

ghostscript is vulnerable to denial of service. An attacker is able to crash the application via a malicious PDF file that results in a long running computation...

Denial Of Service (DoS)

qemu is vulnerable to denial of service DoS. The vulnerability exists in hw/pci/msix.c, allowing a malicious user to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation...

Use-After-Free

sqlite3 is vulnerable to use-after-free. The vulnerability exists in resetAccumulator in select.c due to the parse tree rewrite for window functions is too late...

Content Injection

mailman is vulnerable to content injection. An attacker is able to inject arbitrary content in GNU Mailman...

Privilege Escalation

linux kernel is vulnerable to privilege escalation. A local attacker with monitor perf events permissions is able to corrupt memory and obtain higher privileges...

Privilege Escalation

linux-kvm is vulnerable to privilege escalation. The vulnerability exists as the rbd block device driver in drivers/block/rbd.c used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices...

Privilege Escalation

linux kernel is vulnerable to privilege escalation. A Use-after-free vulnerability in fs/blockdev.callows local users to gain additional privileges or cause a denial of service by leveraging improper access to a certain error field...

Man-in-the-Middle (MitM)

mutt is vulnerable to man-in-the-middle MitM. The vulnerability exists as the connection would not properly close, and would keep retrying, when the $sslforcetls was processed if an IMAP server's initial server response was invalid...

Denial Of Service (DoS)

Node.js is vulnerable to Denial of Service. An attacker may trigger Denial of Service by sending DNS request and getting the application to resolve a DNS record with a larger number of response...

Remote Code Execution

ArchiveTar is vulnerable to remote code execution. An attacker is able to inject malicious code through file extension.PHARwithin a tar archive...

Denial Of Service (DoS)

gdm3 is vulnerable to denial of service DoS. The vulnerability is in gdm3 LPE due to unresponsive accounts-daemon.this could allow a local user to create a new privileged account...

Arbitrary File Overwrite

libreoffice is vulnerable to arbitrary file overwrite. Forms allowed to be submitted to any URI could result in local file overwrite...

Denial Of Service (DoS)

kernel is vulnerable to denial-of-service DoS attacks. The vulnerability exists in dlparparseccproperty in arch/powerpc/platforms/pseries/dlpar.c due to an unchecked kstrdup of prop-name allowing an attacker to cause an application crash...

Use-after-free

kernel is vulnerable to use-after-free. It is possible because of a flaw in drivers/bluetooth/hcildisc.c...

Privilege Escalation

wordpress is vulnerable to privilege escalation. Using XML-RPC allows an unprivileged user to comment on a post as wp-includes/class-wp-xmlrpc-server.php does not enforce the permission to restrict it...

XML External Entity (XXE)

jackson-databind is vulnerable to XML external entity XXE attack. The external DTDs and doctype declarations not disabled by default and allows an attacker to perform XXE attacks against the application using the library...

Arbitrary Code Execution

webkitgtk4 is vulnerable to arbitrary code execution. The vulnerability exists through memory corruption when parsing web content...

Information Disclosure

WebKitGTK+ is vulnerable to information disclosure. Processing maliciously crafted web content may result in the disclosure of process memory...

Arbitrary Code Execution

WebKitGTK+ is vulnerable to arbitrary code execution. A memory corruption issue allows an attacker to execute arbitrary code on the host OS...

Authorization Bypass

github.com/dgrijalva/jwt-go is vulnerable to authorization bypass. The vulnerability exists as the audience verification succeeds even if the type assertion fails when the value of aud is ""...

Cross-site Scripting (XSS)

ovirt-engine is vulnerable to cross-site scripting XSS. The vulnerability exists as it displays and executes unsanitized user controlled parameters...

Cross-site Scripting (XSS)

firefox is vulnerable to cross-site scripting XSS. The vulnerability exists when pasting a tag from the clipboard into a rich text editor, and the CSS sanitizer does not escape characters, and when a webpage subsequently copies the node's innerHTML, and assigns it to another innerHTML...

Denial Of Service (DoS)

graphicsmagick:xenial is vulnerable to denial of service DoS. A NULL pointer dereference vulnerability was found in the function ReadEnhMetaFile in coders/emf.c, which allows attackers to cause a denial of service via a crafted file...

Denial Of Service (DoS)

graphicsmagick:xenial is vulnerable to denial of service DoS. The DrawImage function in magick/render.c in GraphicsMagick does not properly look for pop keywords that are associated with push keywords, which allows remote attackers to cause a denial of service negative strncpy and application cra...

Use-After-Free

qemu is vulnerable to use-after-free. hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to for example a use-after-free outcome...

Denial Of Service (DoS)

linux kernel is vulnerable to denial of service. A NULL pointer dereference in tw5864handleframe in drivers/media/pci/tw5864/tw5864-video.c allows an attacker to crash the application...

Denial Of Service (DoS)

graphicsmagick is vulnerable to denial of service DoS. The vulnerability exists through a NULL pointer dereference vulnerability in the function SVGStartElement in coders/svg.c...

Arbitrary Code Execution

libxml2.so is vulnerable to arbitrary code execution. An integer overflow occurs when comparing schema dates. This could potentially result in arbitrary code execution on the host OS...

Insecure Connection Processing

libcurl.so does not securely handle connections. An application that performs multiple requests with the multi API and sets the CURLOPTCONNECTONLY option when using the setup connect-only transfer, could potentially use the wrong connection and and utilize another connection that was created...

Denial Of Service (DoS)

VLC is vulnerable to denial of service DoS. The vulnerability exists as an exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is followed without...

Denial Of Service (DoS)

python is vulnerable to denial of service DoS. The vulnerability exists as Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the...

Arbitrary Code Execution

Webkit2gtk is vulnerable to arbitrary code execution. The vulnerability exists as a use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content...