Ecosystem
Ubuntu
61,415 known vulnerabilities.
Most affected packages
2,752 results · Clear filters · Feed
-
High 7.8
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to…
KEV Nov 3, 2021 -
Unscored —CVE-2016-3957 Public exploit
The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information…
-
Unscored —
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the…
-
Critical 9.8
jackson-databind is vulnerable to a deserialization flaw
A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
-
Unscored —CVE-2017-1000408 Public exploit
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environm…
-
Unscored —CVE-2017-1000409 Public exploit
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH enviro…
-
Unscored —
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before t…
-
Unscored —CVE-2017-18078 Public exploit
systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the…
-
Unscored —CVE-2018-6323 Public exploit
The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU …
-
Medium 5.5CVE-2018-1047 Public exploit
Improper Input Validation in org.wildfly:wildfly-undertow
A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.
-
Medium 6.5
Moodle SSRF Vulnerability
Moodle 3.x has Server Side Request Forgery in the filepicker.
-
High 7.5
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon cr…
-
Medium 6.1
Cross-Site Scripting (XSS) in jquery
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
-
Medium 6.1CVE-2012-6708 Public exploit
Cross-Site Scripting in jquery
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<…
-
Unscored —CVE-2018-2698 Public exploit
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions t…
-
Unscored —CVE-2018-5764 Public exploit
The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses…
-
Unscored —
gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1…
-
Unscored —
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access co…
-
Unscored —CVE-2017-13216 Public exploit
In ashmem_ioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. This coul…
-
Unscored —CVE-2018-5333 Public exploit
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning…
-
Critical 9.8
jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass
FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readVa…
-
Medium 5.6
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disc…
-
Medium 5.6
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of…
-
Medium 5.6
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disc…
-
Critical 9.8CVE-2017-1000487 Public exploit
OS Command Injection in Plexus-utils
Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.
-
Unscored —
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial…
-
Unscored —CVE-2017-16997 Public exploit
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIG…
-
Unscored —
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and …
-
High 7.5
wolfSSL Bleichenbacher/ROBOT
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as "ROBOT."
-
Unscored —
The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. Th…
-
Unscored —
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.…
-
Unscored —CVE-2016-1252 Public exploit
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.…
-
Unscored —CVE-2017-8824 Public exploit
The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileg…
-
Unscored —
tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-…
-
Unscored —
An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and ol…
-
Unscored —
Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation c…
-
Unscored —
Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. Successful exploit…
-
Unscored —
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/disse…
-
Unscored —CVE-2017-1000405 Public exploit
The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function insid…
-
Unscored —CVE-2017-16994 Public exploit
The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, …