Ecosystem
Debian
61,817 known vulnerabilities.
Most affected packages
3,228 results · Clear filters · Feed
-
Unscored —
contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit per…
-
Unscored —CVE-2012-3414 Public exploit
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before…
-
Unscored —
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NU…
-
Unscored —
Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of se…
-
Unscored —
Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote at…
-
Unscored —CVE-2013-2118 Public exploit
SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "t…
-
Unscored —
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct…
-
Unscored —
The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1…
-
Unscored —CVE-2013-2852 Public exploit
Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43…
-
Low —CVE-2013-2006 Public exploit
OpenStack Keystone Sensitive information disclosure via log files
OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.
-
High 8.4
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data …
KEV Sep 15, 2022 -
Unscored —CVE-2013-1959 Public exploit
kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uid_…
-
Unscored —
The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial …
-
Unscored —
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote att…
-
Unscored —CVE-2009-5029 Public exploit
Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denia…
-
Unscored —CVE-2013-3301 Public exploit
The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointe…
-
Unscored —
Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1p…
-
High 8.5CVE-2013-3239 Public exploit
phpMyAdmin Remote Code Execution
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file a…
-
Medium —
Devise does not properly perform type conversion when performing database queries
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incor…
-
Unscored —
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 …
-
High 7.8
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certai…
KEV Sep 15, 2022 -
Unscored —CVE-2012-6550 Public exploit
Cross-site scripting (XSS) vulnerability in ZeroClipboard before 1.1.4 allows remote attackers to inject arbitrary web …
-
Unscored —
includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitr…
-
Unscored —
Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrar…
-
Unscored —CVE-2013-2503 Public exploit
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server …
-
Unscored —
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl …
-
Unscored —CVE-2013-0292 Public exploit
The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender…
-
Unscored —CVE-2013-1775 Public exploit
sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypa…
-
Unscored —CVE-2013-1773 Public exploit
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privile…
-
Medium —CVE-2013-0212 Public exploit
OpenStack Glance logs user name and password in cleartext
store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote auth…
-
Unscored —CVE-2012-5375 Public exploit
The CRC32C feature in the Btrfs implementation in the Linux kernel before 3.8-rc1 allows local users to cause a denial …
-
Unscored —CVE-2013-0268 Public exploit
The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended c…
-
Unscored —CVE-2013-0160 Public exploit
The Linux kernel through 3.7.9 allows local users to obtain sensitive information about keystroke timing by using the i…
-
Unscored —CVE-2012-4530 Public exploit
The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion, whi…
-
High —
JSON gem has Improper Input Validation vulnerability
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creatio…
-
Unscored —CVE-2013-0238 Public exploit
The try_parse_v4_netmask function in hostmask.c in IRCD-Hybrid before 8.0.6 does not properly validate masks, which all…
-
Unscored —
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other produc…
-
Unscored —
crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in OpenSSL 1.0.1 be…
-
High —
activesupport in Rails vulnerable to incorrect data conversion
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL inject…
-
High —
actionpack Improper Input Validation vulnerability
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks …