Information Disclosure

Google Chrome is vulnerable to Information Disclosure. The vulnerability exists due to the inappropriate implementation in Paint, which allows an attacker to leak cross-origin data outside an iframe via a crafted HTML page...

Denial Of Service (DoS)

Google Chrome is vulnerable to Denial Of Service DoS. The vulnerability exists due to the use after free in the Exosphere, which allows an attacker to engage the user in specific UI interactions to potentially exploit heap corruption via crafted UI interactions, leading to an application crash...

Information Disclosure

389-ds-base is vulnerable to Information Disclosure. The mishandling of a filter may lead to an access control bypass, allowing remote unauthenticated users to search for database items they do not have access to, such as userPassword hashes and other sensitive data...

Denial Of Service (DoS)

opusfile is vulnerable to Denial Of Service DoS. An attacker can crash the application through the packet injection or crafted capture file in the ISO 15765 and ISO 10681 dissectors...

Denial Of Service (DoS)

Linux Kernel is vulnerable to Denial Of Service DoS. The vulnerability exists because an attacker can cause race condition on followpagepte function of gup.c, leading to an application crash...

Heap-based Buffer Overflow

linux is vulnerable to Heap-based Buffer Overflow. A local attacker is able to cause heap-based buffer overflows when a user connects to a malicious USB device which allows the attacker to crash the system or escalate their privileges...

Type Confusion

openssl is vulnerable to type confusion. The vulnerability exists because it may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory content...

LDAP Injection

sssd is vulnerable to LDAP Injection. The vulnerability exists because the libssscertmap fails to sanitize certificate data used in LDAP filters...

Integer Underflow

openvswitch is vulnerable to integer underflow. The vulnerability exists in Organization Specific TLV which allows an attacker to cause an integer underflow...

Regular Expression Denial Of Service (ReDoS)

papapars is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability exists in papaparse.js due to inefficient regular expression complexity which allows an attacker to crash the application by submitting a malicious string...

Denial Of Service (DoS)

net-snmp is vulnerable to Denial Of ServiceDoS. The vulnerability exists in handleipv6IpForwarding in agent/mibgroup/ip-mib/ipscalars.c via a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet...

Information Disclosure

webkitgtk is vulnerable to information disclosure. Processing maliciously crafted web content may disclose sensitive user information due to improper cookie management, which allows a remote attacker to trick the victim into parsing maliciously crafted web content, triggering the vulnerability an...

Out Of Bound Read

xrdp is vulnerable to Out of Bound Reads. The vulnerability exists due to the out of bound read in the xrdpcapsprocessconfirmactive function of the library, allowing an attacker to cause an application crash or access sensitive information...

Remote Code Execution (RCE)

org.apache.karaf.jaas.modules is vulnerable to remote code execution. The vulnerability exists because the doCreateDatasource function in JDBCUtils.java does not properly validate the jndiName parameter in the JNDI scheme when a configuration uses a JNDI LDAP data source URI, allowing an attacker...

Command Injection

cacti is vulnerable to command injection. Authorization can be bypassed due to the implementation of the getclientaddr function. The function is defined in the file lib/functions.php and checks serval $SERVER variables to determine the IP address of the client which allows an attacker to set...

Denial Of Service (DoS)

protobuf-java is vulnerable to Denial Of Service DoS. A remote attacker can cause objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses, when the inputs contain multiple instances of non-repeated embedded messages with...

Use After Free

chromium is vulnerable to use after free. The vulnerability exists in dummy buffer which ends up in a window allowing a remote attacker to potentially exploit heap corruption via malicious input...

Privilege Escalation

DSInternals is vulnerable to privilege escalation. The vulnerability exists in the save function of RoamedCredential.cs because invalid characters are not properly parsed in windows roaming credential service which allows an attacker to write files on the file system with elevate privileges...

Heap Buffer Overflow

Chromium and Electron are vulnerable to a Heap Buffer Overflow. The vulnerability is caused by an out of bounds heap memory write which can result in an application crash...

Cross-site Scripting (XSS)

spatie/browsershot is vulnerable to cross site scripting. The vulnerable exists in the setUrl function in Browsershot.php which allows an external attacker to remotely obtain arbitrary local files, because the application does not validate the passed URL protocol...

Denial Of Service (DoS)

xen is vulnerable to denial of service DoS attacks. P2M pool freeing may take excessively long te P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing may take more time than is reasonable without intermediate preemption checks resulting i...

Remote Code Execution (RCE)

heimdal is vulnerable to remote code execution. The vulnerability exists due to an invalid free in ASN.1 codec which allows an attacker to inject and execute arbitrary codes into the system...

Denial Of Service (DoS)

grub2 is vulnerable to Denial Of Service DoS. The vulnerability exists in grub2 package because of the unicode sequences not properly validate which may lead to a segmentation fault and an application crash...

Denial Of Service (DoS)

Linux kernel’s KVM is vulnerable to denial of service. The vulnerability exists due to a NULL pointer dereference which allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service...

Denial Of Service (DoS)

Linux is vulnerable to Denial Of Service DoS. The vulnerability exists in the ismergeableanonvma function of rmap.c due to a use-after-free related to leaf anonvma double reuse which allows an attacker to cause an application crash by providing malicious input...

Privilege Escalation

github.com/grafana/grafana, is vulnerable to privilege escalation. The vulnerability exists due to the race condition in the authentication middlewares logic, allowing an attacker to query an administration endpoint under a heavy load...

Cross-Site Scripting (XSS)

apacheairflow is vulnerable to cross-site scripting. The vulnerability is due to the origin query argument in the getsafeurl function of views.py which allows an attacker to inject and execute arbitrary scripts...

Out-of-bounds Write

libtiff.so is vulnerable to out-of-bound write. The vulnerability exists due to a heap based buffer overflow in uint32t parameter in tifdir.c which allows an attacker to submit a malicious code file into the system and perform out of bound writes...

Denial Of Service (DoS)

libxml2 is vulnerable to denial of service DoS attacks. A malicious user is able to cause an integer overflow leading to a segmentation fault through a multi-gigabyte XML document when the XMLPARSEHUGE parser option enabled, causing the application to crash...

Improper Access Control

chromium is vulnerable to improper access control. The vulnerability is because of an incorrect security ui due to a flaw found in the Full Screen of the Chromium browser which allows an attacker to perform unauthorized actions...

Arbitrary File Write

postgresql-jdbc is vulnerable to arbitrary file writes. The vulnerability exists because the connection properties for configuring a pgjdbc connection are exposed which allows an attacker to specify arbitrary connection properties could lead to a compromise of a system...

Denial Of Service (DoS)

eap7 is vulnerable to denial of service. The vulnerability exists because the lack of handling by the browser over HTTP/2 may cause overhead or application crashes. This flaw exists because of an incomplete fix for CVE-2021-3629...

Command Injection

snyk-go-plugin is vulnerable to command injection. The vulnerability exists in execute function of sub-process.js because shell for child processes is not properly disabled which allows an attacker to run arbitrary commands on the host system...

Server-side Request Forgery (SSRF)

discovery-plugin-admin-center-starter is vulnerable to server-side request forgery. The vulnerability exists in the routerRestTemplate.getForEntity functionality in the getRouterEntityList function of RouterResourceImpl.java, allowing an attacker to gain sensitive information through the URLs...

Remote Code Execution (RCE)

Redis is vulnerable to Remote Code Execution RCE. The vulnerability exists due to an integer overflow when executing an XAUTOCLAIM command on a stream key in a specific state, with a specially crafted COUNT argument allowing an attacker to inject maliciously crafted code into the system...

Denial Of Service (DoS)

kafka-clients is vulnerable to denial of service. An attacker can crash the application through the OutOfMemoryException in the readArray function of ByteBufferAccessor.java by providing large amounts of memory on brokers...

Information Disclosure

thunderbird is vulnerable to information disclosure. An attacker can gain sensitive information when composing a response to an HTML email with a META refresh tag...

Denial Of Service (DoS)

sdk-server is vulnerable to denial of service. The vulnerability exists because the maximum number of monitored items per session does not properly configure in the getMaxMonitoredItems function of OpcUaServerConfigLimits.java, allowing an attacker to cause an application crash by sending multipl...

Denial Of Service (DoS)

libtiff.so is vulnerable to denial of service. The vulnerability exists due a heap buffer overflow in TIFFReadRawDataStriped function in tiffinfo.c which allows an attacker to cause an application crash via a crafted TIFF file...

Denial Of Service (DoS)

vim is vulnerable to remote code execution. The vulnerability exists due to a use after free allowing an attacker to crash the system via memory corruption...

Denial Of Service (DoS)

chrome is vulnerable to denial of service. The vulnerability exists due to a memory corruption in the functionality of the component SwiftShader allowing an attacker to crash the system via manipulation with an unknown input...

Command Injection

moment-timezone is vulnerable to command injection. An attacker can inject and execute the malicious commands using the childprocess exec function as it does not sanitize the input...

Remote Code Execution (RCE)

vim is vulnerable to remote code execution. The vulnerability exists due to a Use After Free which allowing an attacker to inject maliciously crafted script into the system...

Spoofing Attacks

moodle/moodle is vulnerable to spoofing attacks. The vulnerability exists in the getremoteaddr function in moodlelib.php, allowing an attacker to spoof a user's IP through the X-Forwarded-For headers, bypassing the remote address checks...

Denial Of Service (DoS)

u-boot is vulnerable to denial of service. The vulnerability exists due to the integer signedness error, resulting stack stack-based buffer overflow in the i2c md command, which enables the corruption of the return address pointer of the doi2cmd function...

Out-of-bounds Write

vim is vulnerable to out-of-bounds write. The vulnerability exists due to invalid memory access after diff buffer manipulations in 1diffmarkadjusttp function in diff.c...

SQL Injection

loopback-connector-postgresql is vulnerable to sql injection attacks. The vulnerability exists in buildExpression function in postgresql.js because the user provided inputs for contains loopback filter are not properly sanitized which allows an attacker to inject and execute arbitrary sql command...

Remote Code Execution

drupal/core is vulnerable to remote code execution. A remote attacker is able to bypass protections provided in sanitizeName function because the filenames with .htaccess extension are not properly sanitized, which allows the attacker to upload and execute malicious code on the system under attac...

Out-Of-Bounds Read

vim:sid is vulnerable to out of bounds read. A remote attacker is able to perform out of bound reads...

Denial Of Service (DoS)

xen is vulnerable to denial of service. The vulnerability exists due to an insufficient TLB flush for x86 PV guests in shadow mode which allows an attacker to crash the application by providing a malicious input...