Ecosystem
Debian
61,817 known vulnerabilities.
Most affected packages
3,228 results · Clear filters · Feed
-
Unscored —CVE-2014-0476 Public exploit
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute …
-
Low 3.4
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which ma…
-
Unscored —CVE-2013-1436 Public exploit
code injection in xmonad-contrib
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
-
High 8.8
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, wh…
KEV Oct 2, 2025 -
Unscored —
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial …
-
Unscored —
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers …
-
Unscored —CVE-2014-3631 Public exploit
The assoc_array_gc function in the associative-array implementation in lib/assoc_array.c in the Linux kernel before 3.1…
-
Unscored —
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, wh…
-
Critical 9.8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values o…
KEV Jan 28, 2022 -
Critical 9.8
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, whic…
KEV Jan 28, 2022 -
Unscored —
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dep…
-
Unscored —
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, do…
-
Unscored —CVE-2014-5207 Public exploit
fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NO…
-
Unscored —
Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 bef…
-
Unscored —
The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a de…
-
Unscored —
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a deni…
-
Unscored —CVE-2014-4943 Public exploit
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by…
-
Unscored —CVE-2014-4699 Public exploit
The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the save…
-
Unscored —CVE-2014-1739 Public exploit
The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not init…
-
Unscored —CVE-2014-4014 Public exploit
The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inappl…
-
Unscored —
Stack-based buffer overflow in the sub_read_line_sami function in subreader.c in MPlayer, as used in SMPlayer 0.6.9, al…
-
High 7.8
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two dif…
KEV May 25, 2022 -
Unscored —
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCip…
-
Unscored —
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1…
-
Unscored —
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.…
-
Unscored —
Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.1…
-
Unscored —CVE-2014-3865 Public exploit
Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files ou…
-
Medium 6.1CVE-2014-3146 Public exploit
lxml Cross-site Scripting Via Control Characters
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
-
Medium 5.5
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver …
KEV May 12, 2023 -
Unscored —
Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote att…
-
High —
Arbitrary code execution in Apache Commons BeanUtils
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate…
-
Medium —
DOMPDF Arbitrary File Read
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=…
-
Critical 9.8CVE-2014-0472 Public exploit
Code Injection in Django
The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using u…
-
Unscored —CVE-2011-4089 Public exploit
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary fil…
-
Unscored —CVE-2014-2851 Public exploit
Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local user…
-
Unscored —CVE-2014-0166 Public exploit
The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does…
-
High 7.5
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension pack…
KEV May 4, 2022 -
Unscored —
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to …
-
High 7.5
Commons FileUpload Denial of service vulnerability
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a…
-
Unscored —
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary…