Ecosystem
Debian
61,817 known vulnerabilities.
Most affected packages
linux 20,203
chromium 5,831
linux-6.12 2,889
firefox-esr 1,430
thunderbird 1,395
webkit2gtk 960
imagemagick 867
wireshark 771
wpewebkit 597
xen 487
ffmpeg 442
qemu 442
gpac 393
wordpress 354
freerdp2 319
binutils 301
openssl 296
mediawiki 285
tiff 272
apache2 270
phpmyadmin 263
vim 258
freerdp3 248
asterisk 229
curl 222
samba 204
nvidia-graphics-drivers 198
tcpdump 187
cacti 175
glibc 173
clamav 169
ghostscript 168
python-django 164
bind9 159
wolfssl 151
xorg-server 151
openjdk-17 150
nvidia-graphics-drivers-tesla-470 148
graphicsmagick 147
golang-1.19 143
3,228 results · Clear filters · Feed
-
Medium —CVE-2008-7248 Public exploit
Improper Input Validation in actionpack
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protectio…
-
Unscored —
ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and b…
-
Unscored —
Stack-based buffer overflow in the read_1_3_textobject function in f_readold.c in Xfig 3.2.5b and earlier, and in the r…
-
Unscored —
Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Met…
-
Unscored —CVE-2009-4032 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web scri…
-
Unscored —
Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and …
-
Unscored —CVE-2009-3890 Public exploit
Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress befo…
-
Unscored —CVE-2009-2820 Public exploit
The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly …
-
Critical 9.8
Apache Tomcat affected by vulnerability in TLS and SSL protocol
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Serv…
-
Unscored —CVE-2009-3850 Public exploit
Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains …
-
Unscored —
Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with…
-
Unscored —CVE-2009-3242 Public exploit
Unspecified vulnerability in packet.c in the GSM A RR dissector in Wireshark 1.2.0 and 1.2.1 allows remote attackers to…
-
Unscored —CVE-2009-3241 Public exploit
Unspecified vulnerability in the OpcUa (OPC UA) dissector in Wireshark 0.99.6 through 1.0.8 and 1.2.0 through 1.2.1 all…
-
Unscored —CVE-2009-3233 Public exploit
changetrack 4.3 allows local users to execute arbitrary commands via CRLF sequences and shell metacharacters in a filen…
-
Unscored —
Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, …
-
Unscored —
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cros…
-
Unscored —
Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via an OXM file with a …
-
Unscored —
The rad_decode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service (radiusd crash)…
-
Unscored —CVE-2008-7185 Public exploit
GNOME Rhythmbox 0.11.5 allows remote attackers to cause a denial of service (segmentation fault and crash) via a playli…
-
Unscored —
The tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to caus…
-
Unscored —
Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, m…
-
Unscored —CVE-2009-3042 Public exploit
SQL injection vulnerability in machine.php in Open Computer and Software (OCS) Inventory NG 1.02.1 allows remote attack…
-
Unscored —CVE-2009-3040 Public exploit
Multiple SQL injection vulnerabilities in Open Computer and Software (OCS) Inventory NG 1.02 for Unix allow remote atta…
-
Unscored —CVE-2009-3041 Public exploit
SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (…
-
Unscored —
The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gai…
-
Unscored —CVE-2009-2851 Public exploit
Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attacke…
-
Unscored —
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the…
-
Unscored —
The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before …
-
Unscored —CVE-2009-1894 Public exploit
Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving crea…
-
Unscored —CVE-2009-2334 Public exploit
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access …
-
Unscored —
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the …
-
Unscored —
Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementatio…
-
Unscored —CVE-2009-2286 Public exploit
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a…
-
Unscored —CVE-2009-2285 Public exploit
Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial …
-
Unscored —CVE-2008-6837 Public exploit
SQL injection vulnerability in Zoph 0.7.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified v…
-
Unscored —CVE-2008-6838 Public exploit
Cross-site scripting (XSS) vulnerability in search.php in Zoph 0.7.2.1 allows remote attackers to inject arbitrary web …
-
Unscored —
Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow contex…
-
Unscored —CVE-2009-2174 Public exploit
GUPnP 0.12.7 allows remote attackers to cause a denial of service (crash) via an empty (1) subscription or (2) control …
-
Unscored —CVE-2009-2166 Public exploit
Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to r…
-
Unscored —CVE-2009-1391 Public exploit
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS,…