Ecosystem
Debian
61,995 known vulnerabilities.
Most affected packages
1,866 results · Clear filters · Feed
-
Low 3.5
Spoofing of From field in several screens
An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. This issue affects: ((OTRS)) Community Edition 5.0.x version 5.0.39 and …
-
Low 3.7
A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to cause a deni…
-
Low 3.5
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through …
-
Low —
methodOverride Middleware Reflected Cross-Site Scripting in connect
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
-
Low 2.6
Kubernetes API server follows unvalidated redirects from streaming Kubelet endpoints
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect a…
-
Low 3.7
ecdsa Denial of Service vulnerability in signature verification and signature malleability
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.
-
Low 3.1
RabbitMQ XSS attack via federation and shovel endpoints
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input…
-
Low 2.4
RabbitMQ XSS attack
Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, …
-
Low 1.6CVE-2019-15166 Public exploit
lmp_print in tcpdump lacks certain boundary checks
lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks.
-
Low —
Use of a weak cryptographic algorithm in Gradle
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.
-
Low 2.7
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5…
-
Low 2.7
Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
-
Low 3.5
A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authori…
-
Low 3.5
A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized us…
-
Low 3.1
Uninitialized read in gdImageCreateFromXbm
When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the functi…
-
Low 3.1
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are enc…
-
Low 3.3
A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loa…
-
Low 3.9
AppArmor mount rules grant excessive permissions
In all versions of AppArmor mount rules are accidentally widened when compiled.
-
Low 3.8
mount.ecrpytfs_private sets group owner of /etc/mtab to user's primary group
When mount.ecrpytfs_private before version 87-0ubuntu1.2 calls setreuid() it doesn't also set the effective group id. So when it creates the new version, mtab.tmp, it's created with the group id of the user running mount.ecryptfs_private.
-
Low 2.8
qcow format could expose host filesystem information
Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem.
-
Low 3.3
A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive …
-
Low 3.3
It was discovered the fix for CVE-2018-19758 (libsndfile) was not complete and still allows a read beyond the limits of…
-
Low 3.7
An issue has been found in PowerDNS Recursor versions 4.1.x before 4.1.9 where records in the answer section of respons…
-
Low 3.5
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt …
-
Low 3.1
Ansible sensitive information disclosure
ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
-
Low 2.5
sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_ui…
-
Low 3.1
openstack-mistral Discloses the presence of arbitrary files within the filesystem
A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can ta…
-
Low 3.5
An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via…
-
Low 3.3
An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.
-
Low 3.3
An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in open…
-
Low 3.7
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons …
-
Low 3.3
A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-aft…
-
Low 3.3
The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if…
-
Low 3.7
The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if t…
-
Low 3.3
An out-of-bounds heap buffer read flaw was found in the way advancecomp before 2.1-2018/02 handled processing of ZIP fi…
-
Low 3.3
An out-of-bounds read vulnerability was found in netpbm before 10.61. The expandCodeOntoStack() function has an insuffi…
-
Low 2.6
Undertow Request Smuggling vulnerability
It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.
-
Low 2.3
In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an applic…
-
Low 2.2
Improper Input Validation in ansible
An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.
-
Low 3.8
389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default…