Ecosystem
Debian
62,000 known vulnerabilities.
Most affected packages
11,646 results · Clear filters · Feed
-
Medium 5.9
Out-of-bounds Read in gpac/gpac
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.
-
Medium 5.9
Integer Overflow or Wraparound in gpac/gpac
Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV.
-
Medium 4.0
Floating Point Comparison with Incorrect Operator in gpac/gpac
Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV.
-
Medium 6.5
Out-Of-Bounds Write in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in which there is no offset validation. Abuse of th…
-
Medium 6.5
Out-Of-Bounds Write in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of …
-
Medium 5.3
Out-Of-Bounds Read in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done …
-
Medium 6.5
IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects F…
-
Medium 5.3
Integer-Underflow leading to Out-Of-Bound Read in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemo…
-
Medium 5.3
Missing offset validation leading to Out-of-Bounds Read in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. In particular there is no code…
-
Medium 5.3
Invalid offset validation leading to Out Of Bound Write in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect…
-
Medium 5.3
Missing offset validation leading to Out Of Bound Read in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset valida…
-
Medium 5.3
FreeRDP Null Pointer Dereference leading denial of service
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the `rfx_process_message_ti…
-
Medium 5.9
FreeRDP Out-Of-Bounds Read in nsc_rle_decompress_data
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `con…
-
Medium 5.9
Incorrect offset calculation leading to denial of service in FreeRDP
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient…
-
Medium 4.3
FreeRDP Global-Buffer-Overflow in ncrush_decompress
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overfl…
-
Medium 5.3CVE-2023-4683 Public exploit
NULL Pointer Dereference in gpac/gpac
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.
-
Medium 5.9
Heap-based Buffer Overflow in gpac/gpac
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.
-
Medium 5.1
NULL Pointer Dereference in gpac/gpac
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.
-
Medium 5.1
Divide By Zero in gpac/gpac
Divide By Zero in GitHub repository gpac/gpac prior to 2.3-DEV.
-
Medium 4.0
GitPython blind local file inclusion
GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if …
-
Medium 4.7
Archive spoofing vulnerability in borgbackup
borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the re…
-
Medium 4.2
Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application
Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed.…
-
Medium 5.5
Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c
A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause double-deactivations of catchall elements, which can result in a memory leak.
-
Medium 4.3
Open Redirect Vulnerability in jupyter-server
jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be r…
-
Medium 4.6
cross-site inclusion (XSSI) of files in jupyter-server
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been…
-
Medium 4.3
Pyramid static view path traversal up one directory
Pyramid is an open source Python web framework. A path traversal vulnerability in Pyramid versions 2.0.0 and 2.0.1 impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a `index.html` file that is located exact…
-
Medium 6.1CVE-2023-41080 Public exploit
Apache Tomcat: Open redirect with FORM authentication
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 thr…
-
Medium 6.1
Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports
Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package included as…
-
Medium 5.5
Denial of Service in Gerbv
A user able to control file input to Gerbv, between versions 2.4.0 and 2.10.0, can cause a crash and cause denial-of-service with a specially crafted Gerber RS-274X file.
-
Medium 5.3
Missing Release of Memory after Effective Lifetime in Wireshark
BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
-
Medium 5.3
Uncontrolled Recursion in Wireshark
CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file
-
Medium 5.3
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file
-
Medium 4.4
Apache XML Graphics Batik: Information disclosure vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
-
Medium 6.5
A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38…
-
Medium 6.5
Buffer Overflow vulnerability in FreeImage_Load function in FreeImage Library 3.19.0(r1828) allows attackers to cuase a…
-
Medium 5.5
An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows…
-
Medium 6.1
Horizon Web Dashboard Open Redirect vulnerability
Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.
-
Medium 6.5
In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes …
-
Medium 5.5
Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()
A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service …
-
Medium 6.7
Memory leak in btrfs_get_dev_args_from_path()
A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a system crash or leak internal kernel information