Ecosystem
Ubuntu
61,415 known vulnerabilities.
Most affected packages
2,752 results · Clear filters · Feed
-
Unscored —
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption…
-
Unscored —
If a long user name is used in a username/password combination in a site URL (such as " http://UserName:Password@exampl…
-
Unscored —
An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitab…
-
Unscored —
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. …
-
Unscored —
An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for othe…
-
Unscored —
A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree an…
-
Unscored —
An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leadi…
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iClou…
-
High 8.8
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iClou…
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iClou…
-
Unscored —CVE-2018-4218 Public exploit
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iClou…
-
Unscored —
An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iClou…
-
Critical 9.8
Remote Code Execution in pg
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql whic…
-
Unscored —
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the …
-
Unscored —
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFavico…
-
High —CVE-2016-10542 Public exploit
DoS due to excessively large websocket message in ws
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a `ws` server, it is possible to crash the node process. This affects ws …
-
Unscored —
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remot…
-
Unscored —CVE-2018-11508 Public exploit
The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensiti…
-
High 8.8
Moodle calculated question type allows remote code execution by Question authors
An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.
-
Unscored —
In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrust…
-
Unscored —CVE-2018-1000199 Public exploit
The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result…
-
High 7.3CVE-2018-1122 Public exploit
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unse…
-
Low 3.9CVE-2018-1123 Public exploit
procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection…
-
High 7.3CVE-2018-1124 Public exploit
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec…
-
Critical 9.8
Dolibarr SQL injection vulnerability
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.
-
Medium 5.5
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addre…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful exp…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful ex…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploita…
-
Unscored —
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful ex…
-
Unscored —
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) w…
-
Medium 5.3CVE-2018-1313 Public exploit
Improper Access Control in Apache Derby
In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Secur…
-
Unscored —
GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n seque…
-
Unscored —
An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically …
-
Unscored —CVE-2018-10546 Public exploit
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infi…
-
High 8.1
Command injection in org.apache.tika:tika-core
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a se…
-
Medium 6.6
Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible…
-
Unscored —CVE-2017-7651 Public exploit
In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of co…
-
Unscored —CVE-2018-2844 Public exploit
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions t…
-
Unscored —
A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/…