Ecosystem
Debian
61,802 known vulnerabilities.
Most affected packages
11,598 results · Clear filters · Feed
-
Medium 6.5
ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder
ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that…
-
Medium 5.5
eBook-speaker through 6.2.0 Stack-based Buffer Overflow via element name attribute
eBook-speaker 6.1.0 through 6.2.0 contains a stack buffer overflow vulnerability in get_attributes() in src/common.c caused by an unbounded strcpy of an element's name attribute. Attackers can craft an EPUB or DAISY book with a name attribute of 511 or more c…
-
Medium 6.6
Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction
A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unique sender that created the session. A local attacker can modify another user's live package-management session and re…
-
Medium 6.3
Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass
The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prio…
-
Medium 5.8
ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-mat…
-
Medium 5.5
Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()
Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can …
-
Medium 5.5
A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emi…
-
Medium 4.3
laspy LAS File lasreader.py memory allocation
A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the at…
-
Medium 6.5
Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)
Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_h…
-
Medium 6.1
go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware
go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab…
-
Medium 5.3
CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder
CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 …
-
Medium 6.9
OmniAuth: Host Header Injection Vulnerability
OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host validation is configured.…
-
Medium 5.9
BIG-HKSCS decoding hang on crafted input
Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.
-
Medium 5.9
FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then c…
-
Medium 5.9
FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to …
-
Medium 6.5
FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame
FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO result with payload outstanding. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify, causing a clie…
-
Medium 6.5
FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec
FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset commits new dimensions before buffer reallocation succeeds, and a failed ResetGraphics is only logged. A malicious RDP server can send an over…
-
Medium 6.5
FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap
FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX CREATE_SURFACE PDU, causing an integer wrap and heap buffer overflow on 32-bit builds and an approximately 4 GiB allocation on 64-bit builds. A…
-
Medium 6.5
SPIP before 4.4.29 Authenticated SQL Injection via where Parameter
SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access to inject arbitrary SQL by submitting a differing where parameter value in the POST body versus the GET query string on the /ecrire/?exec=art…
-
Medium 6.1
Reflected XSS via client window id in URL client window mode
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` requ…
-
Medium 5.4
SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile
SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output …
-
Medium 6.1
Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output
Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output. Under use HTML::Tags or use XML::Tags, a double-quoted string literal becomes a StringThing object that holds each interpolated value…
-
Medium 6.1
frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses
In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable mali…
-
Medium 5.3
Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)
The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resultin…
-
Medium 6.3
Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x…
-
Medium 4.8
Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a …
-
Medium 5.5
sngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLV
sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause denial of service via crafted NFLOG TLVs. Attackers can supply a pcap file with link type NFLOG containing a non-payload …
-
Medium 6.1
ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c
ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder p…
-
Medium 6.0
Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record fo…
-
Medium 4.4
arbitrary read/write via grant copy
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination pa…
-
Medium 4.4
arbitrary read/write via grant copy
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination pa…
-
Medium 6.5
Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and consumer state from ids that are user provided and in some scenarios does not validate that they ids are bound to that use…
-
Medium 6.5
Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM
Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subs…
-
Medium 6.5
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary lin…
-
Medium 6.1
CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment
CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment. Arguments are placed between <!-- and --> without escaping, so text containing --> closes the comment early. An application that passes request data to comment can be m…
-
Medium 6.1
CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url
CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url. Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes the %27 that query param…
-
Medium 6.5
CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields
CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields. CGI stores a non-form request body under POSTDATA, PUTDATA or PATCHDATA, and an XForms body under XForms:Model…
-
Medium 6.1
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated c…
-
Medium 6.1
CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form
CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form. url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied REQUEST_URI without va…
-
Medium 6.5
CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer
CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer i…