Ecosystem
Debian
61,812 known vulnerabilities.
Most affected packages
3,227 results · Clear filters · Feed
-
Unscored —CVE-2019-5789 Public exploit
An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed…
-
Unscored —CVE-2019-5788 Public exploit
An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 all…
-
High 7.5
Information exposure in FasterXML jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14…
-
Unscored —CVE-2019-8937 Public exploit
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabe…
-
Medium 5.4CVE-2019-10909 Public exploit
Symfony Cross-site Scripting (XSS) vulnerability
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
-
Critical 9.8
Command Injection in Xstream
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g.…
-
Unscored —CVE-2019-8936 Public exploit
NTP through 4.2.8p12 has a NULL Pointer Dereference.
-
High 7.5CVE-2019-10742 Public exploit
Denial of Service in axios
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.
-
High 7.5
Server Side Request Forgery in Apache Axis
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from so…
-
Unscored —CVE-2019-11599 Public exploit
The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma l…
-
Medium 4.5CVE-2019-3843 Public exploit
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be all…
-
Medium 4.5CVE-2019-3844 Public exploit
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of…
-
Unscored —
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects …
-
Unscored —
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script durin…
-
Unscored —
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check…
-
Unscored —CVE-2019-9813 Public exploit
Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arb…
-
Unscored —
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are J…
-
High 8.8
Local privilege escalation via snapd socket
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
-
Medium 5.7CVE-2019-7303 Public exploit
Snapd seccomp filter TIOCSTI ioctl bypass
A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, …
-
High 7.5CVE-2019-5427 Public exploit
Billion laughs attack in c3p0
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
-
Medium 6.1
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…
-
Medium 4.5CVE-2019-3842 Public exploit
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using …
-
High 7.8
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileg…
KEV Nov 3, 2021 -
Unscored —
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded serv…
-
Unscored —
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1…
-
Unscored —CVE-2018-4442 Public exploit
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1…
-
Unscored —CVE-2018-4443 Public exploit
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1…
-
Unscored —CVE-2018-4438 Public exploit
A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue aff…
-
Unscored —
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to i…
-
Unscored —CVE-2018-4386 Public exploit
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to i…
-
Unscored —CVE-2018-4382 Public exploit
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to i…
-
Unscored —CVE-2018-4328 Public exploit
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to i…
-
Unscored —CVE-2018-4323 Public exploit
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to i…
-
Unscored —CVE-2018-4315 Public exploit
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvO…
-
Unscored —
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvO…
-
Unscored —CVE-2018-4317 Public exploit
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvO…
-
Unscored —CVE-2018-4318 Public exploit
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvO…
-
Unscored —CVE-2018-4306 Public exploit
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvO…
-
Unscored —CVE-2018-4312 Public exploit
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvO…
-
Unscored —CVE-2018-4197 Public exploit
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvO…