Ecosystem
Ubuntu
61,840 known vulnerabilities.
Most affected packages
2,169 results · Clear filters · Feed
-
Low 3.7
Reflected XSS in item configuration window of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predic…
-
Low 3.7
Reflected XSS in service configuration window of Zabbix Frontend
An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to pre…
-
Low 3.8
snapd created ~/snap with too-wide permissions
snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and…
-
Low 2.6
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
-
Low 3.8
Insufficient user authorization in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessin…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions…
-
Low 3.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version tha…
-
Low 3.8
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serializat…
-
Low 3.7
OTF-006: Broken Website Hardening Control: The CSP can be turned on or off but not configured for the specific needs of the website
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resour…
-
Low 3.5
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 a…
-
Low 3.5
Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and…
-
Low 3.3
Incorrect permissions of [/var/run/zabbix] forces dac_override
During Zabbix installation from RPM, DAC_OVERRIDE SELinux capability is in use to access PID files in [/var/run/zabbix] folder. In this case, Zabbix Proxy or Server processes can bypass file read, write and execute permissions check on the file system level
-
Low 3.9
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_d…
-
Low 3.7
An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 all…
-
Low 3.1
A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14…
-
Low 3.5
Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting …
-
Low 3.1
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions star…
-
Low 2.7
Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions st…
-
Low 3.1
Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting fro…
-
Low 2.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions star…
-
Low 3.1
It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 …
-
Low 3.0
Clarify Content-Type handling in OCI spec
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during…
-
Low 3.7
In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may a…
-
Low 1.7
An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting…
-
Low 2.7
In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiti…
-
Low 2.6
Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a proj…
-
Low 3.1
A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause…
-
Low 3.1
Cross-site Scripting (XSS)
This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Logging). Supported versions that are aff…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions…
-
Low 2.7
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported versions that…
-
Low 1.8
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Low 3.7
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…
-
Low 3.7
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported …
-
Low 3.1
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Support…
-
Low 3.5
In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client appl…
-
Low 2.6
Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starti…