Lucene search

K
DebianDebian Linux

9127 matches found

CVE
CVE
added 2020/02/06 5:15 p.m.380 views

CVE-2020-8608

In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.

6.8CVSS6.5AI score0.0181EPSS
CVE
CVE
added 2021/08/05 9:15 p.m.380 views

CVE-2021-3655

A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.

3.3CVSS5.4AI score0.00019EPSS
CVE
CVE
added 2023/10/10 6:15 p.m.380 views

CVE-2023-42795

Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error couldcause Tomcat to skip some parts of the recycling pr...

5.3CVSS7.6AI score0.0051EPSS
CVE
CVE
added 2020/11/12 6:15 p.m.379 views

CVE-2020-8695

Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

5.5CVSS5.5AI score0.00144EPSS
CVE
CVE
added 2019/07/12 8:15 p.m.378 views

CVE-2019-13161

An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an...

5.3CVSS5.3AI score0.02285EPSS
CVE
CVE
added 2020/10/12 6:15 p.m.378 views

CVE-2020-15250

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this dir...

5.5CVSS5.2AI score0.00056EPSS
CVE
CVE
added 2021/03/18 8:15 p.m.378 views

CVE-2021-3416

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU p...

6CVSS6.2AI score0.00003EPSS
CVE
CVE
added 2021/08/23 5:15 a.m.378 views

CVE-2021-37750

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.

6.5CVSS6.6AI score0.00454EPSS
CVE
CVE
added 2020/01/03 4:15 a.m.377 views

CVE-2019-20330

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

9.8CVSS9.2AI score0.01997EPSS
CVE
CVE
added 2020/06/03 3:15 a.m.377 views

CVE-2019-20811

An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.

5.5CVSS5.8AI score0.00033EPSS
CVE
CVE
added 2020/07/06 6:15 p.m.377 views

CVE-2020-14303

A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash.

7.5CVSS7.2AI score0.16342EPSS
CVE
CVE
added 2020/12/03 5:15 p.m.377 views

CVE-2020-14351

A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate privileges. The highest threat from this vulnerability is to data confidentiality and integrity...

7.8CVSS7.7AI score0.00095EPSS
CVE
CVE
added 2020/07/15 6:15 p.m.377 views

CVE-2020-14577

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to c...

4.3CVSS4.4AI score0.002EPSS
CVE
CVE
added 2020/10/06 2:15 p.m.377 views

CVE-2020-25641

A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue req...

5.5CVSS5.8AI score0.00055EPSS
CVE
CVE
added 2020/12/14 8:15 p.m.377 views

CVE-2020-8231

Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

7.5CVSS7.5AI score0.00111EPSS
CVE
CVE
added 2022/01/27 1:15 p.m.377 views

CVE-2022-23181

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is usin...

7CVSS7.2AI score0.93247EPSS
CVE
CVE
added 2019/11/27 9:15 a.m.376 views

CVE-2019-14896

A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects...

10CVSS9.6AI score0.02579EPSS
CVE
CVE
added 2019/02/11 5:29 p.m.375 views

CVE-2018-15587

GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.

6.5CVSS6.5AI score0.01202EPSS
CVE
CVE
added 2020/05/09 9:15 p.m.375 views

CVE-2020-12767

exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by-zero error.

5.5CVSS6.6AI score0.00156EPSS
CVE
CVE
added 2020/07/15 6:15 p.m.375 views

CVE-2020-14621

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple p...

5.3CVSS5.2AI score0.00313EPSS
CVE
CVE
added 2020/03/16 9:15 p.m.375 views

CVE-2020-7919

Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.

7.8CVSS7.3AI score0.00627EPSS
CVE
CVE
added 2021/09/29 8:15 p.m.375 views

CVE-2021-22946

A user can tell curl >= 7.20.0 and

7.5CVSS7.6AI score0.00069EPSS
CVE
CVE
added 2025/01/21 9:15 p.m.375 views

CVE-2025-21490

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise My...

4.9CVSS4.4AI score0.00107EPSS
CVE
CVE
added 2018/06/11 9:29 p.m.374 views

CVE-2017-7805

During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointi...

7.5CVSS8AI score0.04831EPSS
CVE
CVE
added 2020/03/12 9:15 p.m.374 views

CVE-2020-0556

Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access

7.1CVSS6.8AI score0.00169EPSS
CVE
CVE
added 2020/03/31 5:15 a.m.374 views

CVE-2020-11112

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

8.8CVSS8.3AI score0.11418EPSS
CVE
CVE
added 2020/11/16 9:15 p.m.374 views

CVE-2020-26217

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is ...

9.3CVSS8.2AI score0.93566EPSS
Web
CVE
CVE
added 2022/12/05 10:15 p.m.374 views

CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

6.5CVSS7.9AI score0.04594EPSS
CVE
CVE
added 2019/05/08 2:29 p.m.373 views

CVE-2019-11815

An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-after-free, related to net namespace cleanup.

9.3CVSS7.5AI score0.01062EPSS
CVE
CVE
added 2019/08/19 10:15 p.m.373 views

CVE-2019-15217

An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB device in the drivers/media/usb/zr364xx/zr364xx.c driver.

4.9CVSS6.1AI score0.00065EPSS
CVE
CVE
added 2019/11/30 1:15 a.m.373 views

CVE-2019-19462

relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as relay blockage) by triggering a NULL alloc_percpu result.

5.5CVSS5.5AI score0.00101EPSS
CVE
CVE
added 2020/01/02 2:16 p.m.373 views

CVE-2019-20218

selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.

7.5CVSS7.6AI score0.00802EPSS
CVE
CVE
added 2020/10/21 3:15 p.m.373 views

CVE-2020-14798

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multipl...

3.1CVSS3.4AI score0.00247EPSS
CVE
CVE
added 2020/10/21 3:15 p.m.373 views

CVE-2020-14803

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of th...

5.3CVSS4.4AI score0.00046EPSS
CVE
CVE
added 2023/08/22 7:16 p.m.373 views

CVE-2020-23804

Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.

7.5CVSS7.1AI score0.00776EPSS
CVE
CVE
added 2021/04/22 10:15 p.m.373 views

CVE-2021-2161

Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2....

5.9CVSS5.3AI score0.00325EPSS
CVE
CVE
added 2021/06/11 4:15 p.m.373 views

CVE-2021-22898

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uni...

3.1CVSS5.3AI score0.00113EPSS
CVE
CVE
added 2021/07/22 6:15 p.m.373 views

CVE-2021-35942

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but ...

9.1CVSS9.4AI score0.01109EPSS
Web
CVE
CVE
added 2021/07/09 11:15 a.m.373 views

CVE-2021-3612

An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this...

7.8CVSS7.8AI score0.00088EPSS
CVE
CVE
added 2022/05/03 3:15 a.m.373 views

CVE-2022-29824

In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer ...

6.5CVSS6.8AI score0.00043EPSS
CVE
CVE
added 2018/08/03 5:29 p.m.372 views

CVE-2018-14773

An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the ...

6.5CVSS6.5AI score0.03169EPSS
CVE
CVE
added 2020/01/21 6:15 p.m.372 views

CVE-2019-14902

There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would not automatically be taken away on all domain controllers.

5.5CVSS5.9AI score0.01426EPSS
CVE
CVE
added 2020/01/13 6:15 a.m.372 views

CVE-2020-6851

OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.

7.5CVSS7.9AI score0.0122EPSS
CVE
CVE
added 2022/05/12 5:15 a.m.372 views

CVE-2022-30594

The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.

7.8CVSS7.7AI score0.00025EPSS
CVE
CVE
added 2023/07/18 9:15 p.m.372 views

CVE-2023-22006

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle Graa...

3.1CVSS4.2AI score0.00123EPSS
CVE
CVE
added 2023/05/25 8:15 p.m.372 views

CVE-2023-2255

Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load...

5.3CVSS6.1AI score0.55822EPSS
CVE
CVE
added 2023/06/06 8:15 p.m.372 views

CVE-2023-2602

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

3.3CVSS5.5AI score0.00017EPSS
CVE
CVE
added 2024/02/22 5:15 p.m.372 views

CVE-2023-52160

The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 auth...

6.5CVSS6.2AI score0.01494EPSS
Web
CVE
CVE
added 2008/01/10 11:46 p.m.371 views

CVE-2008-0226

Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2) "input_buffer& operator>>" in yassl_imp.cpp.

7.5CVSS7.5AI score0.90142EPSS
Web
CVE
CVE
added 2023/02/09 8:15 p.m.371 views

CVE-2023-22795

A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and

7.5CVSS7.3AI score0.00895EPSS
Total number of security vulnerabilities9127