Ecosystem
Ubuntu
61,415 known vulnerabilities.
Most affected packages
2,752 results · Clear filters · Feed
-
Unscored —
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy…
-
Unscored —CVE-2020-6516 Public exploit
Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a …
-
Unscored —CVE-2020-6514 Public exploit
Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged netwo…
-
Unscored —
Out of bounds write in V8 in Google Chrome prior to 83.0.4103.106 allowed a remote attacker to potentially exploit heap…
-
Unscored —CVE-2020-15780 Public exploit
An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI t…
-
High 7.4CVE-2020-8203 Public exploit
Prototype Pollution in lodash
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
-
High 7.5
Infinite Loop in Apache Tomcat
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payl…
-
High 8.8
Remote code execution via user-provided local names in ActionView
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
-
Unscored —
OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php be…
-
High 7.5
Uncontrolled Resource Consumption in Apache Tomcat
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 conne…
-
Critical 9.8
Improper Authentication in Apache Shiro
Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
-
Low 3.5CVE-2020-11097 Public exploit
OOB read in ntlm_av_pair_get in FreeRDP
In FreeRDP before version 2.1.2, an out of bounds read occurs resulting in accessing a memory location that is outside of the boundaries of the static array PRIMARY_DRAWING_ORDER_FIELD_BYTES. This is fixed in version 2.1.2.
-
Critical 9.8
ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.
-
High 7.5CVE-2020-8162 Public exploit
Circumvention of file size limits in ActiveStorage
A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.
-
Unscored —
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lea…
-
High 8.1CVE-2020-14195 Public exploit
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
-
Unscored —CVE-2020-0198 Public exploit
In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could l…
-
Unscored —
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, w…
-
High 8.8CVE-2020-9802 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, w…
-
Unscored —CVE-2020-10757 Public exploit
A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allo…
-
Medium 6.3
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML att…
KEV Jun 26, 2024 -
Unscored —
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription …
-
Unscored —
GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TL…
-
Critical 9.8
Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()
Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
-
Medium 6.0CVE-2020-10749 Public exploit
containernetworking/plugins vulnerable to MitM attacks
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IP…
-
Medium 5.9CVE-2020-13254 Public exploit
Data leakage via cache key collision in Django
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
-
Medium 6.0CVE-2020-13401 Public exploit
Improper Input Validation in Docker Engine
An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.
-
Medium 4.3CVE-2020-11019 Public exploit
Out of bound read in update_recv in FreeRDP
In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0.
-
High 7.5CVE-2020-11076 Public exploit
HTTP Smuggling via Transfer-Encoding Header in Puma
In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
-
Unscored —CVE-2020-13398 Public exploit
An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto…
-
Unscored —CVE-2020-6468 Public exploit
Type confusion in V8 in Google Chrome prior to 83.0.4103.61 allowed a remote attacker to potentially exploit heap corru…
-
High 7.0
Potential remote code execution in Apache Tomcat
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManage…
-
Unscored —CVE-2020-13152 Public exploit
A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will tr…
-
Medium 5.4CVE-2020-10135 Public exploit
Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent att…
-
High 7.5
A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key…
-
Medium 6.1CVE-2020-7656 Public exploit
Cross-Site Scripting in jquery
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
-
Medium 5.4
-
Low 2.3CVE-2020-11932 Public exploit
Subiquity server installer logged LUKS full disk encryption password
It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.
-
High 7.4
Remote Code Execution in GLPI
In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack…
-
High 7.2CVE-2020-5248 Public exploit
Public GLPIKEY can be used to decrypt any data in GLPI
GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GL…