Ecosystem
Debian
61,817 known vulnerabilities.
Most affected packages
linux 20,203
chromium 5,831
linux-6.12 2,889
firefox-esr 1,430
thunderbird 1,395
webkit2gtk 960
imagemagick 867
wireshark 771
wpewebkit 597
xen 487
ffmpeg 442
qemu 442
gpac 393
wordpress 354
freerdp2 319
binutils 301
openssl 296
mediawiki 285
tiff 272
apache2 270
phpmyadmin 263
vim 258
freerdp3 248
asterisk 229
curl 222
samba 204
nvidia-graphics-drivers 198
tcpdump 187
cacti 175
glibc 173
clamav 169
ghostscript 168
python-django 164
bind9 159
wolfssl 151
xorg-server 151
openjdk-17 150
nvidia-graphics-drivers-tesla-470 148
graphicsmagick 147
golang-1.19 143
3,228 results · Clear filters · Feed
-
Unscored —
GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image di…
-
High 8.8
GNU Wget: stack overflow in HTTP protocol handling
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk len…
-
Unscored —CVE-2017-7089 Public exploit
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud befo…
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud befo…
-
Unscored —CVE-2017-7092 Public exploit
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud befo…
-
Unscored —CVE-2017-15649 Public exploit
net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls…
-
Unscored —CVE-2017-15595 Public exploit
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded rec…
-
Critical 9.8
Remote code execution occurs in Apache Solr
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulner…
-
Unscored —
ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when pro…
-
Unscored —CVE-2017-15235 Public exploit
The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authenticatio…
-
Unscored —CVE-2015-8239 Public exploit
The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts o…
-
High 7.5
Uncontrolled Resource Consumption in Apache ZooKeeper
Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suff…
-
Unscored —
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE…
-
Unscored —
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL c…
-
High 7.8
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb…
KEV Sep 9, 2024 -
Unscored —
Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote…
-
Unscored —
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu…
-
Unscored —
dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vec…
-
Unscored —
Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or exec…
-
Unscored —
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu…
-
Unscored —
Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-s…
-
Unscored —CVE-2017-14939 Public exploit
decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2…
-
Unscored —CVE-2015-1336 Public exploit
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access …
-
Medium 6.1CVE-2017-14735 Public exploit
OWASP AntiSamy Cross-site Scripting vulnerability
OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.
-
Medium 6.1CVE-2015-6748 Public exploit
Improper Neutralization of Input During Web Page Generation in Jsoup
Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.
-
Unscored —
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchiv…
-
Unscored —
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a use…
-
Unscored —CVE-2017-14489 Public exploit
The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users t…
-
Unscored —CVE-2017-1000250 Public exploit
All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability whic…
-
Unscored —
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and inclu…
-
Unscored —CVE-2017-14266 Public exploit
tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file, a relate…
-
Unscored —CVE-2017-9779 Public exploit
OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but w…
-
Unscored —
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to …
-
Unscored —CVE-2017-13672 Public exploit
QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to …
-
High 7.5
RubyGems may allow a maliciously crafted gem to overwrite files
RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
-
Unscored —CVE-2016-10504 Public exploit
Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remot…
-
Unscored —CVE-2017-12865 Public exploit
Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of se…
-
Unscored —CVE-2017-12954 Public exploit
The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of…
-
Unscored —CVE-2017-12952 Public exploit
The LoadString function in helper.h in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer …
-
Unscored —CVE-2017-12950 Public exploit
The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL …